2021-05-18 18:12:44 +02:00
|
|
|
---
|
|
|
|
title: pf.conf
|
|
|
|
description: The template I use on new installations
|
2021-09-13 00:48:07 +02:00
|
|
|
tags:
|
|
|
|
- FreeBSD
|
|
|
|
- firewall
|
|
|
|
- pf
|
2021-05-18 18:12:44 +02:00
|
|
|
---
|
|
|
|
|
|
|
|
## pf.conf
|
|
|
|
|
2022-05-23 18:11:56 +02:00
|
|
|
The open ports list is refined depending on the usage obviously... It is just a template:
|
2021-05-18 18:12:44 +02:00
|
|
|
|
|
|
|
```conf
|
|
|
|
scrub in all
|
|
|
|
|
|
|
|
table <jails> persist
|
|
|
|
table <myself> const { self }
|
|
|
|
table <private> const { 10/8, 172.16/12, 192.168/16, fd00::/8 fe80::/10 }
|
|
|
|
table <internet> const { 0.0.0.0/0, !10/8, !172.16/12, !192.168/16, ::/0, fe80::/10, !fd00::/8 }
|
|
|
|
|
|
|
|
##### Basic rules #####
|
2022-05-23 18:11:56 +02:00
|
|
|
nat pass on egress from <jails> to <internet> -> (egress:0)
|
2021-05-18 18:12:44 +02:00
|
|
|
rdr-anchor "rdr/*"
|
|
|
|
set skip on lo
|
|
|
|
block return log
|
|
|
|
|
|
|
|
##### This firewall #####
|
2022-05-23 18:11:56 +02:00
|
|
|
block drop in on egress
|
2021-05-18 18:12:44 +02:00
|
|
|
pass inet proto icmp all icmp-type unreach code needfrag # MTU path discovery
|
|
|
|
pass inet proto icmp all icmp-type { echoreq, unreach } # echo reply
|
|
|
|
pass inet6 proto icmp6 all
|
|
|
|
|
2022-05-23 18:11:56 +02:00
|
|
|
pass in on egress proto tcp from <internet> to <myself> port { ssh, http, https, smtp, smtps, submission }
|
2021-05-18 18:12:44 +02:00
|
|
|
pass out from <myself> to any
|
2022-05-23 18:11:56 +02:00
|
|
|
|
|
|
|
##### VPNs #####
|
|
|
|
pass in on egress proto udp from <internet> to <myself> port 342
|
|
|
|
pass in on wg0 from <private> to <myself>
|
|
|
|
pass in on wg0 from <private> to <private>
|
|
|
|
pass out on wg0 from <private> to <private>
|
|
|
|
```
|
|
|
|
|
|
|
|
A pre-requisite of this sample is to have set an `egress` group for your egress interface(s) like so in your `/etc/rc.conf`:
|
|
|
|
```conf
|
|
|
|
ifconfig_vtnet0="DHCP group egress"
|
2021-05-18 18:12:44 +02:00
|
|
|
```
|