# System Aliases loopback = "{ lo0 }" lan = "{ ath0 }" wan = "{ vr0 }" enc0 = "{ enc0 }" pptp = "{ ng1 ng2 ng3 ng4 ng5 ng6 ng7 ng8 ng9 ng10 ng11 ng12 ng13 ng14 ng15 ng16 }" OPT1 = "{ vr1 }" # User Aliases SurfboardHacker = "{ 64.18.148.67 209.250.234.170 72.20.13.45 }" set loginterface vr0 set loginterface ath0 set loginterface vr1 set optimization normal set limit states 30000 scrub all random-id fragment reassemble nat-anchor "pftpx/*" nat-anchor "natearly/*" nat-anchor "natrules/*" # FTP proxy rdr-anchor "pftpx/*" # Outbound NAT rules nat on $wan from 192.168.1.0/24 port 500 to any port 500 -> (vr0) port 500 nat on $wan from 192.168.1.0/24 port 5060 to any port 5060 -> (vr0) port 5060 nat on $wan from 192.168.1.0/24 to any -> (vr0) nat on $OPT1 from 192.168.1.0/24 port 500 to any port 500 -> (vr1) port 500 nat on $OPT1 from 192.168.1.0/24 port 5060 to any port 5060 -> (vr1) port 5060 nat on $OPT1 from 192.168.1.0/24 to any -> (vr1) nat on $wan from 192.168.1.192/28 port 500 to any port 500 -> (vr0) port 500 nat on $wan from 192.168.1.192/28 port 5060 to any port 5060 -> (vr0) port 5060 nat on $wan from 192.168.1.192/28 to any -> (vr0) nat on $OPT1 from 192.168.1.192/28 port 500 to any port 500 -> (vr1) port 500 nat on $OPT1 from 192.168.1.192/28 port 5060 to any port 5060 -> (vr1) port 5060 nat on $OPT1 from 192.168.1.192/28 to any -> (vr1) #SSH Lockout Table table persist # Load balancing anchor - slbd updates rdr-anchor "slb" # FTP Proxy/helper table { } no rdr on ath0 proto tcp from any to port 21 rdr on ath0 proto tcp from any to any port 21 -> 127.0.0.1 port 8021 # NAT Inbound Redirects rdr on vr0 proto tcp from any to 98.207.252.13 port { 2222 } -> 192.168.1.1 port 22 rdr on vr1 proto tcp from any to 76.126.222.74 port { 2222 } -> 192.168.1.1 rdr on vr0 proto tcp from any to 98.207.252.13 port { 8080 } -> 192.168.1.1 port 80 rdr on vr1 proto tcp from any to 76.126.222.74 port { 8080 } -> 192.168.1.1 port 80 rdr on vr0 proto tcp from any to 98.207.252.13 port { 3389 } -> 192.168.1.2 rdr on vr1 proto tcp from any to 76.126.222.74 port { 3389 } -> 192.168.1.2 rdr on vr0 proto tcp from any to 98.207.252.13 port { 45526 } -> 192.168.1.2 rdr on vr1 proto tcp from any to 76.126.222.74 port { 45526 } -> 192.168.1.2 # IMSpector rdr anchor rdr-anchor "imspector" # UPnPd rdr anchor rdr-anchor "miniupnpd" anchor "ftpsesame/*" anchor "firewallrules" # We use the mighty pf, we cannot be fooled. block quick proto { tcp, udp } from any port = 0 to any block quick proto { tcp, udp } from any to any port = 0 # snort2c table persist block quick from to any label "Block snort2c hosts" block quick from any to label "Block snort2c hosts" # loopback anchor "loopback" pass in quick on $loopback all label "pass loopback" pass out quick on $loopback all label "pass loopback" # package manager early specific hook anchor "packageearly" # carp anchor "carp" # permit wan interface to ping out (ping_hosts.sh) pass quick proto icmp from 98.207.252.13 to any keep state # NAT Reflection rules # allow access to DHCP server on LAN anchor "dhcpserverlan" pass in quick on $lan proto udp from any port = 68 to 255.255.255.255 port = 67 label "allow access to DHCP server on LAN" pass in quick on $lan proto udp from any port = 68 to 192.168.1.1 port = 67 label "allow access to DHCP server on LAN" pass out quick on $lan proto udp from 192.168.1.1 port = 67 to any port = 68 label "allow access to DHCP server on LAN" # Not installing DHCP server firewall rules for OPT1 which is configured for DHCP. # allow our DHCP client out to the WAN anchor "wandhcp" pass out quick on $wan proto udp from any port = 68 to any port = 67 label "allow dhcp client out wan" block in log quick on $wan proto udp from any port = 67 to 192.168.1.0/24 port = 68 label "block dhcp client out wan" pass in quick on $wan proto udp from any port = 67 to any port = 68 label "allow dhcp client out wan" # LAN/OPT spoof check (needs to be after DHCP because of broadcast addresses) antispoof for ath0 antispoof for vr1 anchor "spoofing" # block anything from private networks on WAN interface anchor "spoofing" antispoof for $wan block in log quick on $wan from 10.0.0.0/8 to any label "block private networks from wan block 10/8" block in log quick on $wan from 127.0.0.0/8 to any label "block private networks from wan block 127/8" block in log quick on $wan from 172.16.0.0/12 to any label "block private networks from wan block 172.16/12" block in log quick on $wan from 192.168.0.0/16 to any label "block private networks from wan block 192.168/16" # Support for allow limiting of TCP connections by establishment rate anchor "limitingesr" table block in quick from to any label "virusprot overload table" # let out anything from the firewall host itself and decrypted IPsec traffic pass out quick on $lan proto icmp keep state label "let out anything from firewall host itself" pass out quick on $wan proto icmp keep state label "let out anything from firewall host itself" pass out quick on vr0 all keep state label "let out anything from firewall host itself" # pass traffic from firewall -> out anchor "firewallout" pass out quick on vr0 all keep state label "let out anything from firewall host itself" pass out quick on ath0 all keep state label "let out anything from firewall host itself" pass out quick on vr1 all keep state label "let out anything from firewall host itself" pass out quick on $pptp all keep state label "let out anything from firewall host itself pptp" pass out quick on $enc0 keep state label "IPSEC internal host to host" # let out anything from the firewall host itself and decrypted IPsec traffic pass out quick on vr1 proto icmp keep state label "let out anything from firewall host itself" pass out quick on vr1 all keep state label "let out anything from firewall host itself" # make sure the user cannot lock himself out of the webGUI or SSH anchor "anti-lockout" pass in quick on ath0 from any to 192.168.1.1 keep state label "anti-lockout web rule" # PPTPd rules anchor "pptp" pass in quick on $wan proto gre from any to 98.207.252.13 keep state label "allow gre pptpd" pass in quick on $wan proto tcp from any to 98.207.252.13 port = 1723 modulate state label "allow pptpd 98.207.252.13" # SSH lockout block in log proto tcp from to any port 22 label "sshlockout" anchor "ftpproxy" anchor "pftpx/*" # User-defined aliases follow table { 64.18.148.67 209.250.234.170 72.20.13.45 } # User-defined rules follow pass in quick on $wan inet proto icmp from any to 98.207.252.13 keep state label "USER_RULE: Allow Ping reply" pass in log quick on $wan proto tcp from any to { 192.168.1.1 } port = 22 keep state label "USER_RULE: NAT SSH -> pfsense" pass in quick on $wan proto tcp from any to { 192.168.1.1 } port = 80 keep state label "USER_RULE: NAT Web Config -> pfsense" pass in log quick on $wan proto tcp from any to 98.207.252.13 port = 1194 keep state label "USER_RULE: OpenVPN -> pfsense" pass in quick on $wan proto tcp from any to { 192.168.1.2 } port = 3389 keep state label "USER_RULE: NAT RDP -> Laptop" pass in quick on $wan proto tcp from any to { 192.168.1.2 } port = 45526 keep state label "USER_RULE: NAT BT -> Laptop" pass in log quick on $wan proto tcp from any to 98.207.252.13 port = 1723 keep state label "USER_RULE: PPTP" pass in quick on $pptp from 192.168.1.192/28 to any keep state label "USER_RULE" pass in quick on $OPT1 reply-to (vr1 76.126.216.1) inet proto icmp from any to 76.126.222.74 keep state label "USER_RULE: Allow Ping reply" pass in quick on $OPT1 reply-to (vr1 76.126.216.1) proto tcp from any to { 192.168.1.2 } port = 45526 keep state label "USER_RULE: NAT BT -> Laptop" pass in quick on $OPT1 reply-to (vr1 76.126.216.1) proto tcp from any to { 192.168.1.2 } port = 3389 keep state label "USER_RULE: NAT RDP -> Laptop" pass in log quick on $OPT1 reply-to (vr1 76.126.216.1) proto tcp from any to 76.126.222.74 port = 1194 keep state label "USER_RULE: OpenVPN -> pfsense" pass in quick on $OPT1 reply-to (vr1 76.126.216.1) proto tcp from any to { 192.168.1.1 } port = 80 keep state label "USER_RULE: NAT Web Config -> pfsense" pass in log quick on $OPT1 reply-to (vr1 76.126.216.1) proto tcp from any to { 192.168.1.1 } port = 22 keep state label "USER_RULE: NAT SSH -> pfsense" pass in quick on $lan proto tcp from any to { 127.0.0.1 } keep state label "USER_RULE" pass in quick on $lan route-to { ( vr0 98.207.252.1 ) } from 192.168.1.0/24 to { 98.207.252.1/23 } keep state label "USER_RULE: WAN DMZ" pass in quick on $lan route-to { ( vr1 76.126.216.1 ) } from 192.168.1.0/24 to { 76.126.216.1/21 } keep state label "USER_RULE: WAN2 DMZ" pass in quick on $lan route-to { ( vr0 98.207.252.1 ) } proto tcp from 192.168.1.0/24 to { 192.168.100.1 } port = 1337 keep state label "USER_RULE: Modem 1 -> WAN1" pass in quick on $lan route-to { ( vr0 98.207.252.1 ) } proto tcp from 192.168.1.0/24 to { 192.168.100.1 } port = 1338 keep state label "USER_RULE: Modem 2 -> WAN2" pass in log quick on $lan route-to { ( vr1 76.126.216.1 ) } from 192.168.1.0/24 to keep state label "USER_RULE: SurfboardHacker -> WAN2" pass in quick on $lan proto tcp from 192.168.1.0/24 to port = 443 keep state label "NEGATE_ROUTE: Negate policy route for local network(s)" pass in quick on $lan route-to { ( vr0 98.207.252.1 ) } proto tcp from 192.168.1.0/24 to any port = 443 keep state label "USER_RULE: HTTPS -> WAN1" pass in log quick on $lan proto gre from 192.168.1.0/24 to keep state label "NEGATE_ROUTE: Negate policy route for local network(s)" pass in log quick on $lan route-to { ( vr0 98.207.252.1 ) } proto gre from 192.168.1.0/24 to any keep state label "USER_RULE: GRE -> WAN1" pass in quick on $lan from 192.168.1.0/24 to keep state label "NEGATE_ROUTE: Negate policy route for local network(s)" pass in quick on $lan route-to { ( vr0 98.207.252.1 ) , ( vr1 76.126.216.1 ) } round-robin from 192.168.1.0/24 to any keep state label "USER_RULE: Load Balance" # VPN Rules pass in quick on ath0 inet proto tcp from any to $loopback port 8021 keep state label "FTP PROXY: Allow traffic to localhost" pass in quick on ath0 inet proto tcp from any to $loopback port 21 keep state label "FTP PROXY: Allow traffic to localhost" pass in quick on vr0 inet proto tcp from port 20 to (vr0) port > 49000 user proxy flags S/SA keep state label "FTP PROXY: PASV mode data connection" # enable ftp-proxy pass in quick on vr1 inet proto tcp from any to $loopback port 8022 keep state label "FTP PROXY: Allow traffic to localhost" pass in quick on vr1 inet proto tcp from any to $loopback port 21 keep state label "FTP PROXY: Allow traffic to localhost" # IMSpector anchor "imspector" # uPnPd anchor "miniupnpd" #--------------------------------------------------------------------------- # default rules (just to be sure) #--------------------------------------------------------------------------- block in log quick all label "Default block all just to be sure." block out log quick all label "Default block all just to be sure."