Changes between Initial Version and Version 1 of FreeBSD PF Firewall Examples

Timestamp:

03/09/21 08:45:33 (4 years ago)

Author:

Paul Kulda

Comment:

--

FreeBSD PF Firewall Examples

@@ +1 @@
+= FreeBSD PF Firewall Examples =
+
+PF Example for VPN / OPENVPN / NAT :
+
+{{{
+### Interfaces ###
+ExtIf ="em0"
+BackIf ="em1"
+TunIf ="tun0"
+
+### Services ###
+my_ssh_services = "{ 22, 53, 2222, 2525 }"
+my_web_services = "{ 80, 443 }"
+
+### Hosts / Networks / Groups ###
+outside_ip ="111.22.33.44"
+outside_ip6 ="111:222:333:44::5"
+back_ip ="192.168.19.1"
+remote_net = "192.168.1.0/24"
+back_net = "192.168.19.0/24"
+vpn_net = "192.168.20.0/24"
+
+### Options ###
+set block-policy drop
+set fingerprints "/etc/pf.os"
+set ruleset-optimization none
+
+### Timeouts ###
+set optimization normal
+set timeout { tcp.closing 60, tcp.established 7200 }
+
+### Queues, States and Types ###
+TcpState ="flags S/SA modulate state"
+PlainState ="flags S/SA keep state"
+UdpState ="keep state"
+
+### Stateful Tracking Options (STO) ###
+OpenSTO = "(max 90000, source-track rule, max-src-conn 1000, max-src-nodes 256)"
+SmtpSTO = "(max   200, source-track rule, max-src-conn   10, max-src-nodes 256, max-src-conn-rate 200/30)"
+SshSTO  = "(max   100, source-track rule, max-src-conn   64, max-src-nodes 100, max-src-conn-rate 100/30,  overload <childrens> flush global)"
+WebSTO  = "(max  4096, source-track rule, max-src-conn 256, max-src-nodes 512, max-src-conn-rate 500/100, overload <childrens> flush global)"
+
+scrub log on $ExtIf all reassemble tcp fragment reassemble
+scrub out on $ExtIf no-df random-id
+
+set skip on lo0
+
+nat on $ExtIf from $vpn_net to any -> $outside_ip static-port
+nat on $ExtIf from $back_net to any -> $outside_ip static-port
+
+no rdr
+
+# Final rule - goes first.
+block in log all
+
+# Inbound
+# SSH
+pass in on $ExtIf proto tcp from any to { $outside_ip, $outside_ip6 } \
+port $my_ssh_services $TcpState $SshSTO
+
+# Web
+pass in on $ExtIf proto tcp from any to { $outside_ip, $outside_ip6 } \
+port $my_web_services $TcpState $WebSTO
+
+# Allow anything from remote network to backend network
+pass in quick on $TunIf reply-to $TunIf from $remote_net to $back_net $UdpState
+pass in quick on $TunIf reply-to $TunIf proto tcp from $remote_net to $back_net $TcpState
+pass in quick on $TunIf reply-to $TunIf inet proto icmp from $remote_net to $back_net
+
+# This server outbound
+pass out on $ExtIf from $outside_ip to any $UdpState
+pass out on $ExtIf proto tcp from $outside_ip to any $TcpState
+pass out on $ExtIf inet proto icmp from $outside_ip to any
+pass out on $ExtIf inet6 proto ipv6-icmp from $outside_ip6 to any
+
+pass out on $BackIf from $back_ip to any $UdpState
+pass out on $BackIf proto tcp from $back_ip to any $TcpState
+pass out on $BackIf inet proto icmp from $back_ip to any
+
+# Allow outbound from VPN clients
+pass in on $TunIf from $vpn_net to any $UdpState
+pass in on $TunIf proto tcp from $vpn_net to any $TcpState
+pass in on $TunIf inet proto icmp from $vpn_net to any
+
+# All outbound from backend network
+pass in on $BackIf from $back_net to !$remote_net $UdpState
+pass in on $BackIf proto tcp from $back_net to !$remote_net $TcpState
+pass in on $BackIf inet proto icmp from $back_net to !$remote_net
+
+# End of config
+}}}