From 1577007f83a3d3210bc1280cc324702a8fe0002c Mon Sep 17 00:00:00 2001 From: Julien Dessaux Date: Mon, 23 May 2022 18:11:56 +0200 Subject: Updated freebsd pf article --- content/docs/freebsd/pf.md | 21 +++++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-) diff --git a/content/docs/freebsd/pf.md b/content/docs/freebsd/pf.md index d94db23..e6cf6e7 100644 --- a/content/docs/freebsd/pf.md +++ b/content/docs/freebsd/pf.md @@ -9,11 +9,9 @@ tags: ## pf.conf -The open ports list is refined depending on the usage obviously... It is just a template : +The open ports list is refined depending on the usage obviously... It is just a template: ```conf -ext_if=vtnet0 - scrub in all table persist @@ -22,17 +20,28 @@ table const { 10/8, 172.16/12, 192.168/16, fd00::/8 fe80::/10 } table const { 0.0.0.0/0, !10/8, !172.16/12, !192.168/16, ::/0, fe80::/10, !fd00::/8 } ##### Basic rules ##### -nat pass on $ext_if from to -> ($ext_if:0) +nat pass on egress from to -> (egress:0) rdr-anchor "rdr/*" set skip on lo block return log ##### This firewall ##### -block drop in on $ext_if +block drop in on egress pass inet proto icmp all icmp-type unreach code needfrag # MTU path discovery pass inet proto icmp all icmp-type { echoreq, unreach } # echo reply pass inet6 proto icmp6 all -pass in on $ext_if proto tcp from to port { ssh, http, https, smtp, smtps, submission } +pass in on egress proto tcp from to port { ssh, http, https, smtp, smtps, submission } pass out from to any + +##### VPNs ##### +pass in on egress proto udp from to port 342 +pass in on wg0 from to +pass in on wg0 from to +pass out on wg0 from to +``` + +A pre-requisite of this sample is to have set an `egress` group for your egress interface(s) like so in your `/etc/rc.conf`: +```conf +ifconfig_vtnet0="DHCP group egress" ``` -- cgit v1.2.3