set limit table-entries 400000 set optimization normal set limit states 198000 set limit src-nodes 198000 #System aliases loopback = "{ lo0 }" WAN = "{ vmx0 }" LAN = "{ vmx1 }" ISPB_LAN = "{ vmx2 }" pppoe = "{ pppoe }" OpenVPN = "{ openvpn }" #SSH Lockout Table table persist #Snort tables table table table persist file "/etc/bogons" table persist file "/etc/bogonsv6" table { 10.0.10.0/24 } table { 10.0.10.0/24 } # User Aliases table { 185.63.80.23 185.63.80.24 } DNS_Servers = "" table { 92.205.8.252/32 } eurolinkconnect_com = "" # Gateways GWGW_WAN = " route-to ( vmx0 185.63.83.6 ) " GWPeplink = " route-to ( vmx1 10.0.5.253 ) " set loginterface vmx1 set skip on pfsync0 set keepcounters scrub on $WAN inet all fragment reassemble scrub on $WAN inet6 all fragment reassemble scrub on $LAN inet all fragment reassemble scrub on $LAN inet6 all fragment reassemble scrub on $ISPB_LAN inet all fragment reassemble scrub on $ISPB_LAN inet6 all fragment reassemble no nat proto carp no rdr proto carp nat-anchor "natearly/*" nat-anchor "natrules/*" # Outbound NAT rules (manual) # Outbound NAT rules (automatic) # Subnets to NAT table { 127.0.0.0/8 ::1/128 10.0.0.0/23 10.0.5.0/24 10.10.10.0/24 10.202.0.0/16 10.0.10.0/24 } nat on $WAN inet from to any port 500 -> 185.63.83.1/32 static-port nat on $WAN inet6 from to any port 500 -> (vmx0) static-port nat on $WAN inet from to any -> 185.63.83.1/32 port 1024:65535 nat on $WAN inet6 from to any -> (vmx0) port 1024:65535 # TFTP proxy rdr-anchor "tftp-proxy/*" # NAT Inbound Redirects rdr on vmx0 inet proto tcp from any to 185.63.83.1 port 443 -> 10.0.5.21 rdr on vmx0 inet proto tcp from any to 185.63.83.1 port 8022 -> 10.0.5.21 port 22 rdr on vmx1 inet proto { tcp udp } from any to !10.0.5.254 port 53 -> 127.0.0.1 rdr on vmx2 inet proto { tcp udp } from any to ! $DNS_Servers port 53 -> 127.0.0.1 rdr on vmx0 inet proto tcp from any to 185.63.83.1 port 8443 -> 10.202.50.2 port 80 rdr on vmx0 inet proto tcp from any to 185.63.83.1 port 3389 -> 10.202.50.2 # UPnPd rdr anchor rdr-anchor "miniupnpd" anchor "openvpn/*" anchor "ipsec/*" # block IPv4 link-local. Per RFC 3927, link local "MUST NOT" be forwarded by a routing device, # and clients "MUST NOT" send such packets to a router. FreeBSD won't route 169.254./16, but # route-to can override that, causing problems such as in redmine #2073 block in quick from 169.254.0.0/16 to any tracker 1000000101 label "Block IPv4 link-local" block in quick from any to 169.254.0.0/16 tracker 1000000102 label "Block IPv4 link-local" #--------------------------------------------------------------------------- # default deny rules #--------------------------------------------------------------------------- block in inet all tracker 1000000103 label "Default deny rule IPv4" block out inet all tracker 1000000104 label "Default deny rule IPv4" block in inet6 all tracker 1000000105 label "Default deny rule IPv6" block out inet6 all tracker 1000000106 label "Default deny rule IPv6" # IPv6 ICMP is not auxiliary, it is required for operation # See man icmp6(4) # 1 unreach Destination unreachable # 2 toobig Packet too big # 128 echoreq Echo service request # 129 echorep Echo service reply # 133 routersol Router solicitation # 134 routeradv Router advertisement # 135 neighbrsol Neighbor solicitation # 136 neighbradv Neighbor advertisement pass quick inet6 proto ipv6-icmp from any to any icmp6-type {1,2,135,136} tracker 1000000107 keep state # Allow only bare essential icmpv6 packets (NS, NA, and RA, echoreq, echorep) pass out quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type {129,133,134,135,136} tracker 1000000108 keep state pass out quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type {129,133,134,135,136} tracker 1000000109 keep state pass in quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type {128,133,134,135,136} tracker 1000000110 keep state pass in quick inet6 proto ipv6-icmp from ff02::/16 to fe80::/10 icmp6-type {128,133,134,135,136} tracker 1000000111 keep state pass in quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type {128,133,134,135,136} tracker 1000000112 keep state pass in quick inet6 proto ipv6-icmp from :: to ff02::/16 icmp6-type {128,133,134,135,136} tracker 1000000113 keep state # We use the mighty pf, we cannot be fooled. block quick inet proto { tcp, udp } from any port = 0 to any tracker 1000000114 label "Block traffic from port 0" block quick inet proto { tcp, udp } from any to any port = 0 tracker 1000000115 label "Block traffic to port 0" block quick inet6 proto { tcp, udp } from any port = 0 to any tracker 1000000116 label "Block traffic from port 0" block quick inet6 proto { tcp, udp } from any to any port = 0 tracker 1000000117 label "Block traffic to port 0" # Snort package block quick from to any tracker 1000000118 label "Block snort2c hosts" block quick from any to tracker 1000000119 label "Block snort2c hosts" # CARP rules block in quick proto carp from (self) to any tracker 1000000201 pass quick proto carp tracker 1000000202 no state # SSH lockout block in quick proto tcp from to (self) port 22 tracker 1000000301 label "sshguard" # webConfigurator lockout block in quick proto tcp from to (self) port 8080 tracker 1000000351 label "GUI Lockout" block in quick from to any tracker 1000000400 label "virusprot overload table" # block bogon networks (IPv4) # http://www.cymru.com/Documents/bogon-bn-nonagg.txt block in quick on $WAN from to any tracker 11001 label "block bogon IPv4 networks from WAN" # block bogon networks (IPv6) # http://www.team-cymru.org/Services/Bogons/fullbogons-ipv6.txt block in quick on $WAN from to any tracker 11002 label "block bogon IPv6 networks from WAN" antispoof for $WAN tracker 1000001570 # block anything from private networks on interfaces with the option set block in quick on $WAN from 10.0.0.0/8 to any tracker 12001 label "Block private networks from WAN block 10/8" block in quick on $WAN from 127.0.0.0/8 to any tracker 12002 label "Block private networks from WAN block 127/8" block in quick on $WAN from 172.16.0.0/12 to any tracker 12003 label "Block private networks from WAN block 172.16/12" block in quick on $WAN from 192.168.0.0/16 to any tracker 12004 label "Block private networks from WAN block 192.168/16" block in quick on $WAN from fc00::/7 to any tracker 12005 label "Block ULA networks from WAN block fc00::/7" antispoof for $LAN tracker 1000002620 # allow access to DHCP server on LAN pass in quick on $LAN proto udp from any port = 68 to 255.255.255.255 port = 67 tracker 1000002641 label "allow access to DHCP server" pass in quick on $LAN proto udp from any port = 68 to 10.0.5.254 port = 67 tracker 1000002642 label "allow access to DHCP server" pass out quick on $LAN proto udp from 10.0.5.254 port = 67 to any port = 68 tracker 1000002643 label "allow access to DHCP server" antispoof for $ISPB_LAN tracker 1000003670 # loopback pass in on $loopback inet all tracker 1000005811 label "pass IPv4 loopback" pass out on $loopback inet all tracker 1000005812 label "pass IPv4 loopback" pass in on $loopback inet6 all tracker 1000005813 label "pass IPv6 loopback" pass out on $loopback inet6 all tracker 1000005814 label "pass IPv6 loopback" # let out anything from the firewall host itself and decrypted IPsec traffic pass out inet all keep state allow-opts tracker 1000005815 label "let out anything IPv4 from firewall host itself" pass out inet6 all keep state allow-opts tracker 1000005816 label "let out anything IPv6 from firewall host itself" pass out route-to ( vmx0 185.63.83.6 ) from 185.63.83.1 to !185.63.83.0/29 tracker 1000005911 keep state allow-opts label "let out anything from firewall host itself" pass out route-to ( vmx0 185.63.83.6 ) from 185.63.83.4 to !185.63.83.0/29 tracker 1000005912 keep state allow-opts label "let out anything from firewall host itself" # make sure the user cannot lock himself out of the webConfigurator or SSH pass in quick on vmx1 proto tcp from any to (vmx1) port { 8080 } tracker 10001 keep state label "anti-lockout rule" # User-defined rules follow anchor "userrules/*" pass in quick on $OpenVPN inet from any to any tracker 1637758041 keep state label "USER_RULE: OpenVPN Open VPN Clients wizard" pass in log quick on $pppoe inet proto udp from 10.202.100.2 to any port 53 tracker 1636998356 keep state label "USER_RULE" pass in quick on $pppoe inet from { 10.202.0.0/16 } to any tracker 1605617135 keep state label "USER_RULE: PPPoE Clients" pass in quick on $WAN reply-to ( vmx0 185.63.83.6 ) inet from 93.95.124.21 to any tracker 1621597719 keep state label "USER_RULE: VoiceFlex / Swyx SIP trunks" pass in quick on $WAN reply-to ( vmx0 185.63.83.6 ) inet from 185.63.80.25 to any tracker 1620398175 keep state label "USER_RULE: Eurolink Monitoring" pass in quick on $WAN reply-to ( vmx0 185.63.83.6 ) inet from 46.31.86.11 to any tracker 1605765974 keep state label "USER_RULE: Eurolink" pass in quick on $WAN reply-to ( vmx0 185.63.83.6 ) inet proto udp from any to 185.63.83.1 port 1194 tracker 1637758040 keep state label "USER_RULE: OpenVPN Open VPN Clients wizard" block in quick on $WAN reply-to ( vmx0 185.63.83.6 ) inet from any to any tracker 1630514765 label "USER_RULE: block all" pass in log quick on $LAN inet from 10.0.0.101 to any tracker 1630567770 keep state label "USER_RULE" pass in log quick on $LAN inet proto { tcp udp } from 10.0.0.10 to any port 4500 tracker 1620398331 keep state label "USER_RULE: IPSec VPN" pass in log quick on $LAN inet proto { tcp udp } from 10.0.0.10 to any port 1194 tracker 1620398420 keep state label "USER_RULE: OpenVPN" pass in log quick on $LAN inet proto { tcp udp } from 10.0.0.10 to any port 1723 tracker 1620398401 keep state label "USER_RULE: PTP VPN" pass in log quick on $LAN inet proto { tcp udp } from 10.0.0.10 to any port 1701 tracker 1620398372 keep state label "USER_RULE: L2TP VPN" pass in log quick on $LAN inet proto { tcp udp } from 10.0.0.10 to any port 500 tracker 1620398356 keep state label "USER_RULE: ISAKMP VPN" pass in quick on $LAN inet from 10.0.5.0/24 to any tracker 0100000101 keep state label "USER_RULE: Default allow LAN to any rule" # source address is empty. label "USER_RULE: Default allow LAN IPv6 to any rule" pass in quick on $ISPB_LAN inet from 10.10.10.0/24 to any tracker 1635177894 keep state label "USER_RULE" # VPN Rules anchor "tftp-proxy/*"