# cat rules.debug # System Aliases loopback = "{ lo0 }" lan = "{ re0 }" ng0 = "{ fxp1 ng0 }" wan = "{ fxp1 ng0 }" WAN2 = "{ fxp2 }" # User Aliases set loginterface fxp1 set loginterface re0 set loginterface fxp2 set optimization normal scrub on ng0 all random-id max-mss 1452 fragment reassemble # UPnPd rdr anchor rdr-anchor "upnpd/*" nat-anchor "pftpx/*" nat-anchor "natearly/*" nat-anchor "natrules/*" # FTP proxy rdr-anchor "pftpx/*" nat on $ng0 from 10.0.0.0/24 port 500 to any port 500 -> (ng0) port 500 nat on $ng0 from 10.0.0.0/24 to any -> (ng0) nat on $WAN2 from 10.0.0.0/24 to any -> (fxp2) #SSH Lockout Table table persist # Load balancing anchor - slbd updates rdr-anchor "slb" # FTP Proxy/helper rdr on $lan proto tcp from any to any port 21 -> 127.0.0.1 port 8021 rdr on $WAN2 proto tcp from any to any port 21 -> 127.0.0.1 port 8022 rdr on re0 inet proto tcp to !(re0) port 80 -> (re0) port 3128 pass quick on re0 inet proto tcp to !(re0) port 80 flags S/SA keep state anchor "ftpsesame/*" anchor "firewallrules" # loopback anchor "loopback" pass in quick on $loopback all label "pass loopback" pass out quick on $loopback all label "pass loopback" # package manager early specific hook anchor "packageearly" # carp anchor "carp" # enable ftp-proxy pass in quick on fxp2 inet proto tcp from any to $loopback port 8022 keep state label "FTP PROXY: Allow traffic to localhost" pass in quick on fxp2 inet proto tcp from any to $loopback port 21 keep state la bel "FTP PROXY: Allow traffic to localhost" anchor "ftpproxy" anchor "pftpx/*" pass in quick on re0 inet proto tcp from any to $loopback port 8021 keep state l abel "FTP PROXY: Allow traffic to localhost" pass in quick on re0 inet proto tcp from any to $loopback port 21 keep state lab el "FTP PROXY: Allow traffic to localhost" pass in quick on ng0 inet proto tcp from port 20 to (ng0) port > 49000 user prox y flags S/SA keep state label "FTP PROXY: PASV mode data connection" # NAT Reflection rules # allow access to DHCP server on LAN anchor "dhcpserverlan" pass in quick on $lan proto udp from any port = 68 to 255.255.255.255 port = 67 label "allow access to DHCP server on LAN" pass in quick on $lan proto udp from any port = 68 to 10.0.0.29 port = 67 label "allow access to DHCP server on LAN" pass out quick on $lan proto udp from 10.0.0.29 port = 67 to any port = 68 label "allow access to DHCP server on LAN" block in log quick on $wan proto udp from any port = 67 to 10.0.0.0/24 port = 68 label "allow dhcp client out wan" pass in quick on $wan proto udp from any port = 67 to any port = 68 label "allow dhcp client out wan" # LAN/OPT spoof check (needs to be after DHCP because of broadcast addresses) antispoof for re0 antispoof for fxp2 # block anything from private networks on WAN interface anchor "spoofing" block in log quick on $wan from 10.0.0.0/8 to any label "block private networks from wan block 10/8" block in log quick on $wan from 127.0.0.0/8 to any label "block private networks from wan block 127/8" block in log quick on $wan from 172.16.0.0/12 to any label "block private networ ks from wan block 172.16/12" block in log quick on $wan from 192.168.0.0/16 to any label "block private netwo rks from wan block 192.168/16" # Support for allow limiting of TCP connections by establishment rate anchor "limitingesr" table block in quick from to any label "virusprot overload table" # let out anything from the firewall host itself and decrypted IPsec traffic pass out quick on ng0 all keep state label "let out anything from firewall host itself" # pass traffic from firewall -> out anchor "firewallout" pass out quick on { fxp1 ng0 } all keep state label "let out anything from fir ewall host itself" pass out quick on re0 all keep state label "let out anything from firewall host itself" pass out quick on fxp2 all keep state label "let out anything from firewall host itself" # let out anything from the firewall host itself and decrypted IPsec traffic pass out quick on fxp2 all keep state label "let out anything from firewall host itself" # make sure the user cannot lock himself out of the webGUI or SSH anchor "anti-lockout" pass in quick from 10.0.0.0/24 to 10.0.0.29 keep state label "anti-lockout web r ule" # SSH lockout block in log proto tcp from to any port 22 label "sshlockout" # User-defined rules follow pass in quick on $lan route-to ( fxp2 192.168.7.1 ) from { 10.0.0.12 } to any keep state label "USER_RULE: Uberworx -> Secondary Wan" pass in quick on $lan from 10.0.0.0/24 to any keep state label "USER_RULE: Defa ult LAN -> any" # VPN Rules #--------------------------------------------------------------------------- # default rules (just to be sure) #--------------------------------------------------------------------------- block in log quick all label "Default block all just to be sure." block out log quick all label "Default block all just to be sure."