# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # This configuration is set for use on a machine that is a router with # three (3) network cards: # ext_if - connects to the upstream link (cable/dsl modem, WAN, etc.) # wifi_if - wireless card for internal network # (if none present, remove all references to it in this file) # lan_if - wired card for internal network # (if none present, remove all references to it in this file) # # Required order: options, normalization, queueing, translation, filtering. # Macros and tables may be defined and used anywhere. # Note that translation rules are first match while filter rules are last match. # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #------------------------------------------------------------------------ # macros #------------------------------------------------------------------------ logopt = "log" # interfaces ext_if = "bge0" #wifi_if = "ath0" lan_if = "bge1" # publically accesible services (transport layer neutral) pubserv = "{ 80, 443, ftp, ftp-data, 65500:65535 }" #ftpserv = "{ ftp, ftp-data, 65500:65535 }" # remote administration with RealVNC vnc_tcp_port = "5900" vnc_client = "192.168.1.76" # internally accessible services (transport layer neutral) lanserv = "{ 22, 53, 67, 80, 443, 25, 110, 995, 587, 21, 1626, 8021, 3128, 2082, 2095, 8080, 8083, 4080, \ 8090, 143, 5999, 8102, 8096, 8091, 8092, 7777, 8000 }" # samba ports (transport layer neutral) samba_ports = "{ 42, 81, 135, 137, 138, 139, 445 }" # externally permitted inbound icmp types icmp_types = "echoreq" # internal network lan_net = "{ 192.168.0.0/24, 192.168.1.0/24 }" # hosts granted acces to samba (cifs/smb) shares smb_net = "{ 192.168.0.0/24, 192.168.1.0/24, 192.168.0.90, 192.168.1.90 }" proxy_serv = "{ 21, 80, 443 }" # MSN Messenger msn_tcp_port = "{1863,6901,6891:6900}" msn_udp_port = "{1503,3889,5004:65535}" msn_messenger = "192.168.1.14" # P2P mldonkey = "192.168.7.100" # P2P ports for BitTorrent and Donkey2000 bittorrent = "{ 6880, 6881:6889 }" donkey2000_tcp = "{ 4662, 10696 }" donkey2000_udp = "{ 4665, 4672 65535, 10700, 10838 }" # IPs de los streamers streamers = "{ 192.168.1.120,192.168.1.121,192.168.1.122,192.168.1.123,\ 192.168.1.128,192.168.1.130,192.168.1.131,192.168.1.250 }" # puertos para Windows Media Player rtsp_ports_tcp = "{ 554,8554 }" # rtsp 554 TCP rtsp_ports_udp = "{ 554,5004,5005,8554 }" # rtsp 5004 y 5005 UDP mms_ports_tcp = "{ 1755 }" # mms 1755 TCP mms_ports_udp = "{ 1755,1770,1024:5000 }" # mms 1755, 1024-5000 UDP msb_ports_udp = "{ 1:65535 }" # msb 1-65535 UDP # Streambox server 1770 UDP #------------------------------------------------------------------------ # tables #------------------------------------------------------------------------ # block these networks table { 0.0.0.0/8, 10.0.0.0/8, 20.20.20.0/24, 127.0.0.0/8, \ 169.254.0.0/16, 172.16.0.0/12, 192.0.2.0/24, 192.168.0.0/16, \ 224.0.0.0/3, 255.255.255.255 } ############################################################################## ### Required order: options, normalization, queueing, translation, filtering. ############################################################################## #------------------------------------------------------------------------ # options #------------------------------------------------------------------------ # config set block-policy return set loginterface $ext_if set skip on lo0 set optimization aggressive #------------------------------------------------------------------------ # normalization #------------------------------------------------------------------------ #scrub all reassemble tcp no-df #scrub in all fragment reassemble scrub out all random-id #------------------------------------------------------------------------ # Queueing #------------------------------------------------------------------------ # pendiente! #------------------------------------------------------------------------ # translation, redirection #------------------------------------------------------------------------ # network address translation no nat on $ext_if from $lan_net to any port $proxy_serv nat on $ext_if from $lan_net to any -> ($ext_if) #rdr outgoing WWW requests to the squid (disable if you using wpad.dat) #no rdr on $lan_if inet proto tcp from 192.168.1.250 to any port $proxy #rdr on $lan_if inet proto tcp from any to any port www -> 127.0.0.1 port 3128 # remote administration RealVNC #rdr on $ext_if proto tcp from any to any port $vnc_tcp_port -> $vnc_client port $vnc_tcp_port # P2P # MLDonkey web interfaz rdr on $ext_if proto tcp from any to any port 4080 -> $mldonkey #Bittorrent rdr on $ext_if proto {tcp, udp} from any to any port $bittorrent -> $mldonkey #Donkey2000 rdr on $ext_if proto {tcp, udp} from any to any port $donkey2000_udp -> $mldonkey #------------------------------------------------------------------------ # firewall policy #------------------------------------------------------------------------ # restrictive default rules block all block return-rst in $logopt on $ext_if proto tcp all block return-icmp in $logopt on $ext_if proto udp all block in $logopt on $ext_if proto icmp all block out $logopt on $ext_if all # trust localhost pass in quick on lo0 all pass out quick on lo0 all # anti fake return-scans block return-rst out on $ext_if proto tcp all block return-rst in on $ext_if proto tcp all block return-icmp out on $ext_if proto udp all block return-icmp in on $ext_if proto udp all # toy with script kiddies scanning us block in $logopt quick proto tcp flags FUP/WEUAPRSF block in $logopt quick proto tcp flags WEUAPRSF/WEUAPRSF block in $logopt quick proto tcp flags SRAFU/WEUAPRSF block in $logopt quick proto tcp flags /WEUAPRSF block in $logopt quick proto tcp flags SR/SR block in $logopt quick proto tcp flags SF/SF #block in on $ext_if from any to #"Block drop in quick" will kill the rdr rules above for the privnet block drop in on $ext_if from to any block drop out on $ext_if from any to # Block ssh bruteforce attempts http://johan.fredin.info/openbsd/block_ssh_bruteforce.html # special rule for ssh pass in on $ext_if proto tcp from any to ($ext_if) port ssh \ flags S/SA keep state \ (max-src-conn-rate 3/30, overload flush global) # block the ssh bruteforce bastards block drop in quick on $ext_if from # open firewall fully # warning: insecure! #pass in quick all #pass out quick all # Bloquear la ip de un equipo a un puerto especifico (DoS a Squid) #block drop in quick on $lan_if inet proto tcp from 192.168.1.250 to any port 3128 # Bloquear la ip de un equipo completamente #block drop in quick on $lan_if from 192.168.1.250 # allow permitted icmp pass in inet proto icmp all icmp-type $icmp_types keep state # allow permitted services pass in on $ext_if inet proto tcp from any to any port $pubserv flags S/SA keep state #pass in on {$lan_if $wifi_if} inet proto {tcp udp} from $lan_net to any port $lanserv keep state pass in on $lan_if inet proto {tcp udp} from $lan_net to any port $lanserv keep state #pass in on {$lan_if $wifi_if} inet proto {tcp udp} from $smb_net to any port $samba_ports keep state pass in on $lan_if inet proto {tcp udp} from $smb_net to any port $samba_ports keep state # allow ftp conections #pass in on $ext_if inet proto tcp from any to any port $ftpserv flags S/SA keep state #pass in on $ext_if inet proto tcp from any to any port ftp keep state #pass in on $ext_if inet proto tcp from any to any port ftp-data keep state #pass in on $ext_if inet proto tcp from any to any port > 65499 keep state #pass in on $ext_if inet proto tcp from any to port {ftp, ftp-data} flags S/SA keep state # allow permited vnc pass in on $ext_if inet proto tcp from any to any port $vnc_tcp_port flags S/SA keep state pass in on $lan_if inet proto tcp from $lan_net to any port $vnc_tcp_port keep state # permit access between LAN hosts #pass in from $lan_net to $lan_net keep state #pass out from $lan_net to $lan_net keep state # Permitimos Window Media Player a $streamers a puertos $rtsp_ports $mms_ports $msb_ports # Nota: IE=proxy manual, WMP=proxy manual y puertos abiertos en el firewall. pass in quick on $lan_if inet proto tcp from $streamers to any port $rtsp_ports_tcp flags S/SA keep state pass in quick on $lan_if inet proto udp from $streamers to any port $rtsp_ports_udp pass in quick on $lan_if inet proto tcp from $streamers to any port $mms_ports_tcp flags S/SA keep state pass in quick on $lan_if inet proto udp from $streamers to any port $mms_ports_udp pass in quick on $lan_if inet proto tcp from $streamers to any port >1024 flags S/SA keep state #MSN Messenger port pass in quick on $lan_if inet proto tcp from $msn_messenger to any port $msn_tcp_port flags S/SA keep state pass in quick on $lan_if inet proto udp from $msn_messenger to any port $msn_udp_port #pass in quick on $lan_if inet proto tcp from 192.168.1.122 to any port >1024 flags S/SA keep state # MLDonkey web interfaz pass in on $ext_if proto tcp from any to $mldonkey port 4080 # BitTorrent pass in on $ext_if proto {tcp, udp} from any to $mldonkey port $bittorrent # Donkey2000 pass in on $ext_if proto tcp from any to $mldonkey port $donkey2000_tcp flags S/SA keep state pass in on $ext_if proto udp from any to $mldonkey port $donkey2000_udp # permit full outbound access # warning: potentially insecure. you may wish to lock down outbound access. pass out from any to any keep state