>все правила pf ? # Interfaces
int_if="rl0"
ext_if="rl1"
# routers IPs
int_ip="192.168.0.2"
ext_ip="xxx.xxx.xxx.xxx"
# Other IPs
local_net="192.168.0.0/24"
tfs_ip="192.168.0.60"
ftp_ip="{ xxx.xxx.xxx.xxx, xxx.xxx.xxx.xxx, xxx.xxx.xxx.xxx, xxx.xxx.xxx.xxx, xxx.xxx.xxx.xxx, xxx.xxx.xxx.xxx, xxx.xxx.xxx.xxx }"
o_ip="{ xxx.xxx.xxx.xxx, xxx.xxx.xxx.xxx, xxx.xxx.xxx.xxx, xxx.xxx.xxx.xxx, xxx.xxx.xxx.xxx, xxx.xxx.xxx.xxx, xxx.xxx.xxx.xxx }"
vpn_ip="{ xxx.xxx.xxx.xxx, xxx.xxx.xxx.xxx }"
dns_ip="{ xxx.xxx.xxx.xxx, xxx.xxx.xxx.xxx }"
# Stateful macros
syn_state="flags S/SA synproxy state"
tcp_state="flags S/SA modulate state"
udp_icmp_state="keep state"
# Allow ports
common_ports="{ ssh, aol, ircd, rdp, 8080 }"
me_tcp_ports="{ www, https, 3128, ssh }"
me_udp_ports="{ domain, ntp }"
mail_ports="{ pop3, pop3s, smtp, smtps }"
ipsec_ports="{ 500, 4500, 10000, 20000 }"
ftp_port="8021"
dhcpd_ports="{ 67, 68 }"
wow_ports="{ 3724, 8879 }"
cod_ports="28960"
# ICMP-types macros
icmp_good="icmp-type 8 code 0"
# Stateful tracking options macros
www_track="(max 300, source-track rule, max-src-conn 100, max-src-nodes 50, max-src-states 5)"
ftp_track="(max-src-conn 5, max-src-conn-rate 3/30, overload <ftp-bruteforce> flush global)"
ssh_track="(max-src-conn 5, max-src-conn-rate 3/30, overload <ssh-bruteforce> flush global)"
# Table
table <ssh-bruteforce> persist
table <ftp-bruteforce> persist
# Misc Options
set debug urgent
set block-policy drop
set loginterface $ext_if
set state-policy if-bound
set fingerprints "/etc/pf.os"
set ruleset-optimization none
# Timeout Options
set optimization normal
set timeout { frag 30, tcp.established 28800 }
set timeout { tcp.first 120, tcp.closing 120, tcp.closed 120, tcp.finwait 120 }
set timeout { udp.first 120, udp.single 120, udp.multiple 120 }
set timeout { adaptive.start 6000, adaptive.end 12000 }
################ Skip ######################################
set skip on lo
################ Normalization #############################
scrub in log on $ext_if all random-id fragment reassemble
scrub log on $ext_if all reassemble tcp
################ Translation ###############################
no rdr on lo0 from any to any
nat on $ext_if from !($ext_if) to any -> ($ext_if:0)
# Ftp ( secure ftp-proxy for the internal LAN )
nat-anchor "ftp-proxy/*"
rdr-anchor "ftp-proxy/*"
rdr on $int_if inet proto tcp from $int_if:network to !$int_ip port ftp -> lo0 port $ftp_port
########### TFS redirect ##############
rdr on $ext_if inet proto tcp from any to $ext_ip port 83 -> $tfs_ip port 83
rdr on $ext_if inet proto tcp from $o_ip to $ext_ip port rdp -> $tfs_ip port rdp
rdr on $ext_if inet proto tcp from any to $ext_ip port 8080 -> $tfs_ip port 8080
rdr on $ext_if inet proto tcp from $o_ip to $ext_ip port 1433 -> $tfs_ip port 1433
################ Filtering #################################
# Deny bruteforce Atacks
block drop in quick on $ext_if from <ssh-bruteforce>
block drop in quick on $ext_if from <ftp-bruteforce>
# Deny spoofed packets
antispoof log quick for { lo0 $int_if }
# Drop to/from illegal sources/destinations
block quick inet6
block in log quick from no-route to any
block in quick on $ext_if from any to 255.255.255.255
# BLOCK all in/out on all interfaces and log by default
block log on $ext_if
block return log on $int_if
#Block NMAP
block quick from any os NMAP
# Ftp ( secure ftp-proxy )
anchor "ftp-proxy/*"
# Icmp from any to any
pass log inet proto icmp from any to any $icmp_good
# In from $local_net to me
pass in log on $int_if inet proto udp from 0.0.0.0 port bootpc to 255.255.255.255 port bootps $udp_icmp_state tag Local_DHCPD
pass out log on $int_if inet proto udp from 255.255.255.255 port bootps to 0.0.0.0 port bootpc $udp_icmp_state tag Local_DHCPD
pass in log on $int_if inet proto udp from $local_net port bootpc to $int_ip port bootps $udp_icmp_state tag Local_DHCPD
pass in log on $int_if inet proto tcp from $local_net to lo0 port $ftp_port $tcp_state tag Local_FTP-PROXY
pass in log on $int_if inet proto tcp from $local_net to $int_ip port $me_tcp_ports $tcp_state
pass in log on $int_if inet proto udp from $local_net to $int_ip port $me_udp_ports $udp_icmp_state
pass in log on $int_if inet proto tcp from $local_net to $int_ip port { ftp, ftp-data } $tcp_state tag Local_active_FTPD
pass in log on $int_if inet proto tcp from $local_net to $int_ip port 65500:65535 $tcp_state tag Local_passive_FTPD
# In from any to me
pass in quick log on $ext_if inet proto tcp from any to $ext_ip port ssh $tcp_state $ssh_track tag INTERNET_SSHD
pass in quick log on $ext_if inet proto tcp from any to $ext_ip port { ftp, ftp-data } $tcp_state $ftp_track tag INTERNET_ACTIVE_FTPD
pass in quick log on $ext_if inet proto tcp from any to $ext_ip port 65500:65535 $tcp_state tag INTERNET_PASSIVE_FTPD
# In from any to $local_net
pass log inet proto tcp from any to $tfs_ip port 83 $tcp_state
pass log inet proto tcp from any to $tfs_ip port 8080 $tcp_state
pass log inet proto tcp from $o_ip to $tfs_ip port rdp $tcp_state
pass log inet proto tcp from $o_ip to $tfs_ip port 1433 $tcp_state
# In from $local_net to any
pass in log on $int_if inet proto tcp from $local_net to any port $common_ports $tcp_state
pass in log on $int_if inet proto tcp from $local_net to any port $mail_ports $tcp_state
pass in log on $int_if inet proto tcp from $tfs_ip to $o_ip port { www, 8080 } $tcp_state
pass in log on $int_if inet proto { tcp, udp } from $local_net to $o_ip port $ipsec_ports $udp_icmp_state
pass in log on $int_if inet proto tcp from $local_net to any port $wow_ports $tcp_state
pass in log on $int_if inet proto tcp from $local_net to $vpn_ip port pptp $tcp_state
pass in log on $int_if inet proto gre from $local_net to $vpn_ip $udp_icmp_state
# Out from $local_net, me to any
pass out log on $ext_if inet proto tcp to any $tcp_state
pass out log on $ext_if inet proto udp to any $udp_icmp_state
pass out log on $int_if inet proto udp from $int_ip to $local_net port snmp $udp_icmp_state
block out log on $ext_if inet proto { tcp udp } to any port $dhcpd_ports
Вариант для распечатки
OpenNET: Виртуальная конференция (Public)
(ok) on 06-Авг-08, 11:07 
