set limit table-entries 400000 set optimization normal set limit states 198000 set limit src-nodes 198000 #System aliases loopback = "{ lo0 }" WAN = "{ em0 }" LAN = "{ em1 }" SYNC = "{ em2 }" OOB = "{ em3 }" #SSH Lockout Table table persist #Snort tables table table table persist file "/etc/bogons" table # User Aliases svc_fwmgmt = "{ 22 443 }" table { 10.0.0.200 } test = "" # Gateways GWWAN_DHCP6 = " " set loginterface em1 set skip on pfsync0 scrub on $WAN all fragment reassemble scrub on $LAN all fragment reassemble scrub on $SYNC all fragment reassemble scrub on $OOB all fragment reassemble no nat proto carp no rdr proto carp nat-anchor "natearly/*" nat-anchor "natrules/*" # Outbound NAT rules are disabled # Load balancing anchor rdr-anchor "relayd/*" # TFTP proxy rdr-anchor "tftp-proxy/*" # UPnPd rdr anchor rdr-anchor "miniupnpd" anchor "relayd/*" anchor "openvpn/*" anchor "ipsec/*" # block IPv4 link-local. Per RFC 3927, link local "MUST NOT" be forwarded by a routing device, # and clients "MUST NOT" send such packets to a router. FreeBSD won't route 169.254./16, but # route-to can override that, causing problems such as in redmine #2073 block in log quick from 169.254.0.0/16 to any tracker 1000105581 label "Block IPv4 link-local" block in log quick from any to 169.254.0.0/16 tracker 1000105582 label "Block IPv4 link-local" #--------------------------------------------------------------------------- # default deny rules #--------------------------------------------------------------------------- block in log inet all tracker 1000105583 label "Default deny rule IPv4" block out log inet all tracker 1000105584 label "Default deny rule IPv4" block in log inet6 all tracker 1000105585 label "Default deny rule IPv6" block out log inet6 all tracker 1000105586 label "Default deny rule IPv6" # IPv6 ICMP is not auxilary, it is required for operation # See man icmp6(4) # 1 unreach Destination unreachable # 2 toobig Packet too big # 128 echoreq Echo service request # 129 echorep Echo service reply # 133 routersol Router solicitation # 134 routeradv Router advertisement # 135 neighbrsol Neighbor solicitation # 136 neighbradv Neighbor advertisement pass quick inet6 proto ipv6-icmp from any to any icmp6-type {1,2,135,136} tracker 1000105587 keep state # Allow only bare essential icmpv6 packets (NS, NA, and RA, echoreq, echorep) pass out quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type {129,133,134,135,136} tracker 1000105588 keep state pass out quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type {129,133,134,135,136} tracker 1000105589 keep state pass in quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type {128,133,134,135,136} tracker 1000105590 keep state pass in quick inet6 proto ipv6-icmp from ff02::/16 to fe80::/10 icmp6-type {128,133,134,135,136} tracker 1000105591 keep state pass in quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type {128,133,134,135,136} tracker 1000105592 keep state pass in quick inet6 proto ipv6-icmp from :: to ff02::/16 icmp6-type {128,133,134,135,136} tracker 1000105593 keep state # We use the mighty pf, we cannot be fooled. block log quick inet proto { tcp, udp } from any port = 0 to any tracker 1000105594 label "Block traffic from port 0" block log quick inet proto { tcp, udp } from any to any port = 0 tracker 1000105595 label "Block traffic to port 0" block log quick inet6 proto { tcp, udp } from any port = 0 to any tracker 1000105596 label "Block traffic from port 0" block log quick inet6 proto { tcp, udp } from any to any port = 0 tracker 1000105597 label "Block traffic to port 0" # Snort package block log quick from to any tracker 1000105598 label "Block snort2c hosts" block log quick from any to tracker 1000105599 label "Block snort2c hosts" block in log quick proto carp from (self) to any tracker 1000105681 pass quick proto carp tracker 1000105682 no state # SSH lockout block in log quick proto tcp from to (self) port 22 tracker 1000105781 label "sshguard" # webConfigurator lockout block in log quick proto tcp from to (self) port 443 tracker 1000105831 label "GUI Lockout" block in log quick from to any tracker 1000000400 label "virusprot overload table" # allow our DHCPv6 client out to the WAN pass in quick on $WAN proto udp from fe80::/10 port = 546 to fe80::/10 port = 546 tracker 1000106041 label "allow dhcpv6 client in WAN" pass in quick on $WAN proto udp from any port = 547 to any port = 546 tracker 1000106042 label "allow dhcpv6 client in WAN" # Add Priority to dhcp6c packets if enabled pass out quick on $WAN proto udp from any port = 546 to any port = 547 tracker 1000106043 label "allow dhcpv6 client out WAN" antispoof log for $WAN tracker 1000107050 antispoof log for $LAN tracker 1000108100 # allow access to DHCP server on LAN pass in quick on $LAN proto udp from any port = 68 to 255.255.255.255 port = 67 tracker 1000108121 label "allow access to DHCP server" pass in quick on $LAN proto udp from any port = 68 to 172.168.0.102 port = 67 tracker 1000108122 label "allow access to DHCP server" pass out quick on $LAN proto udp from 172.168.0.102 port = 67 to any port = 68 tracker 1000108123 label "allow access to DHCP server" # allow access to DHCPv6 server on LAN # We need inet6 icmp for stateless autoconfig and dhcpv6 pass quick on $LAN inet6 proto udp from fe80::/10 to fe80::/10 port = 546 tracker 1000108131 label "allow access to DHCPv6 server" pass quick on $LAN inet6 proto udp from fe80::/10 to ff02::/16 port = 546 tracker 1000108132 label "allow access to DHCPv6 server" pass quick on $LAN inet6 proto udp from fe80::/10 to ff02::/16 port = 547 tracker 1000108133 label "allow access to DHCPv6 server" pass quick on $LAN inet6 proto udp from ff02::/16 to fe80::/10 port = 547 tracker 1000108134 label "allow access to DHCPv6 server" antispoof log for $SYNC tracker 1000109150 antispoof log for $OOB tracker 1000110200 # loopback pass in on $loopback inet all tracker 1000110241 label "pass IPv4 loopback" pass out on $loopback inet all tracker 1000110242 label "pass IPv4 loopback" pass in on $loopback inet6 all tracker 1000110243 label "pass IPv6 loopback" pass out on $loopback inet6 all tracker 1000110244 label "pass IPv6 loopback" # let out anything from the firewall host itself and decrypted IPsec traffic pass out inet all keep state allow-opts tracker 1000110245 label "let out anything IPv4 from firewall host itself" pass out inet6 all keep state allow-opts tracker 1000110246 label "let out anything IPv6 from firewall host itself" # User-defined rules follow anchor "userrules/*" block in quick on $WAN inet from any to (self) tracker 1561568064 label "USER_RULE" block in quick on $WAN inet from $test to (self) tracker 1561568293 label "USER_RULE: Shouldn t be necesary but explicitly blocking tes..." pass in quick on $WAN inet proto tcp from $test to 172.168.0.0/24 port 22 tracker 1561568226 flags S/SA keep state label "USER_RULE" block in quick on $LAN inet from any to (self) tracker 1561568266 label "USER_RULE" pass in quick on $LAN inet from 172.168.0.0/24 to any tracker 0100000101 keep state label "USER_RULE: Default allow LAN to any rule" pass in quick on $SYNC inet from 192.168.0.0/24 to any tracker 1561568888 keep state label "USER_RULE" pass in quick on $OOB inet proto tcp from 192.168.2.0/24 to 192.168.2.3 port $svc_fwmgmt tracker 1561577414 flags S/SA keep state label "USER_RULE" # VPN Rules anchor "tftp-proxy/*"