adyxax/www
1
0
Fork 0
Code Issues Activity

Updated freebsd pf article

Browse source
This commit is contained in:
Julien Dessaux 2022-05-23 18:11:56 +02:00
parent 76797ad8d8
commit 1577007f83
Signed by: adyxax
GPG key ID: F92E51B86E07177E
1 changed files with 15 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
content/docs/freebsd/pf.md
View file

@ -12,8 +12,6 @@ tags:
The open ports list is refined depending on the usage obviously... It is just a template: The open ports list is refined depending on the usage obviously... It is just a template:
```conf ```conf
ext_if=vtnet0
scrub in all scrub in all
table <jails> persist table <jails> persist
@ -22,17 +20,28 @@ table <private> const { 10/8, 172.16/12, 192.168/16, fd00::/8 fe80::/10 }
table <internet> const { 0.0.0.0/0, !10/8, !172.16/12, !192.168/16, ::/0, fe80::/10, !fd00::/8 } table <internet> const { 0.0.0.0/0, !10/8, !172.16/12, !192.168/16, ::/0, fe80::/10, !fd00::/8 }
##### Basic rules ##### ##### Basic rules #####
nat pass on $ext_if from <jails> to <internet> -> ($ext_if:0) nat pass on egress from <jails> to <internet> -> (egress:0)
rdr-anchor "rdr/*" rdr-anchor "rdr/*"
set skip on lo set skip on lo
block return log block return log
##### This firewall ##### ##### This firewall #####
block drop in on $ext_if block drop in on egress
pass inet proto icmp all icmp-type unreach code needfrag # MTU path discovery pass inet proto icmp all icmp-type unreach code needfrag # MTU path discovery
pass inet proto icmp all icmp-type { echoreq, unreach } # echo reply pass inet proto icmp all icmp-type { echoreq, unreach } # echo reply
pass inet6 proto icmp6 all pass inet6 proto icmp6 all
pass in on $ext_if proto tcp from <internet> to <myself> port { ssh, http, https, smtp, smtps, submission } pass in on egress proto tcp from <internet> to <myself> port { ssh, http, https, smtp, smtps, submission }
pass out from <myself> to any pass out from <myself> to any
##### VPNs #####
pass in on egress proto udp from <internet> to <myself> port 342
pass in on wg0 from <private> to <myself>
pass in on wg0 from <private> to <private>
pass out on wg0 from <private> to <private>
```
A pre-requisite of this sample is to have set an `egress` group for your egress interface(s) like so in your `/etc/rc.conf`:
```conf
ifconfig_vtnet0="DHCP group egress"
``` ```