set hostid 0x4e0e44e9 set limit table-entries 20000000 set optimization conservative set timeout { udp.first 300, udp.single 150, udp.multiple 900 } set limit states 812000 set limit src-nodes 812000 #System aliases loopback = "{ lo0 }" PUBLIC_IP_DMZ = "{ vmx0 }" ADMIN_LAN = "{ vmx1 }" SERVERS_LAN = "{ vmx2 }" Tailscale = "{ Tailscale }" #SSH Lockout Table table persist #Snort tables table table table persist file "/etc/bogons" table persist file "/etc/bogonsv6" # User Aliases table { 192.168.7.5 } Graylog = "" table { 192.168.7.2 192.168.7.4 } HWS_DCs = "" table { 192.168.76.254 } Nokia = "" table persist file "/var/db/aliastables/pfB_Asia_v4.txt" pfB_Asia_v4 = "" table persist file "/var/db/aliastables/pfB_Asia_v6.txt" pfB_Asia_v6 = "" pfB_DNSBL_Ports = "{ 80 443 }" table { 10.10.10.1 ::10.10.10.1 } pfB_DNSBL_VIPs = "" table persist file "/var/db/aliastables/pfB_DoH_6_v6.txt" pfB_DoH_6_v6 = "" table persist file "/var/db/aliastables/pfB_DoH_IP_v4.txt" pfB_DoH_IP_v4 = "" table persist file "/var/db/aliastables/pfB_Europe_v4.txt" pfB_Europe_v4 = "" table persist file "/var/db/aliastables/pfB_Europe_v6.txt" pfB_Europe_v6 = "" table persist file "/var/db/aliastables/pfB_Homeworld_ASN_v4.txt" pfB_Homeworld_ASN_v4 = "" table persist file "/var/db/aliastables/pfB_Internic_4_v4.txt" pfB_Internic_4_v4 = "" table persist file "/var/db/aliastables/pfB_Internic_6_v6.txt" pfB_Internic_6_v6 = "" table persist file "/var/db/aliastables/pfB_PRI1_6_v6.txt" pfB_PRI1_6_v6 = "" table persist file "/var/db/aliastables/pfB_PRI1_v4.txt" pfB_PRI1_v4 = "" table persist file "/var/db/aliastables/pfB_PRI2_v4.txt" pfB_PRI2_v4 = "" table persist file "/var/db/aliastables/pfB_PS_v4.txt" pfB_PS_v4 = "" table persist file "/var/db/aliastables/pfB_PS_v6.txt" pfB_PS_v6 = "" table persist file "/var/db/aliastables/pfB_SCANNERS_v4.txt" pfB_SCANNERS_v4 = "" table persist file "/var/db/aliastables/pfB_Top_v4.txt" pfB_Top_v4 = "" table persist file "/var/db/aliastables/pfB_Top_v6.txt" pfB_Top_v6 = "" table { REDACTED } Public_IPs = "" table { REDACTED } Public_IPs_No_UDM_Chimera = "" table { 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 } RFC1918 = "" table { REDACTED } UDMSE = "" # Gateways GWPUBLIC_IP_DMZ_DHCP = " route-to ( vmx0 REDACTED ) " set loginterface vmx1 set skip on pfsync0 set keepcounters # Ethernet rules scrub from any to fragment no reassemble scrub from to any fragment no reassemble scrub on $PUBLIC_IP_DMZ inet all random-id fragment reassemble scrub on $PUBLIC_IP_DMZ inet6 all random-id fragment reassemble scrub on $ADMIN_LAN inet all random-id fragment reassemble scrub on $ADMIN_LAN inet6 all random-id fragment reassemble scrub on $SERVERS_LAN inet all random-id fragment reassemble scrub on $SERVERS_LAN inet6 all random-id fragment reassemble no nat proto carp no rdr proto carp nat-anchor "natearly/*" nat-anchor "natrules/*" # Outbound NAT rules (automatic) # Subnets to NAT tonatsubnets = "{ 127.0.0.0/8 ::1/128 192.168.0.0/24 192.168.7.0/24 }" nat on $PUBLIC_IP_DMZ inet from $tonatsubnets to any port 500 -> REDACTED static-port nat on $PUBLIC_IP_DMZ inet6 from $tonatsubnets to any port 500 -> (vmx0) static-port nat on $PUBLIC_IP_DMZ inet from $tonatsubnets to any -> REDACTED port 1024:65535 nat on $PUBLIC_IP_DMZ inet6 from $tonatsubnets to any -> (vmx0) port 1024:65535 # TFTP proxy rdr-anchor "tftp-proxy/*" # NAT Inbound Redirects rdr on vmx0 inet proto udp from $Nokia to REDACTED port 1517 -> $Graylog anchor "openvpn/*" anchor "ipsec/*" # block IPv4 link-local. Per RFC 3927, link local "MUST NOT" be forwarded by a routing device, # and clients "MUST NOT" send such packets to a router. FreeBSD won't route 169.254./16, but # route-to can override that, causing problems such as in redmine #2073 block in log quick from 169.254.0.0/16 to any ridentifier 1000000101 label "Block IPv4 link-local" block in log quick from any to 169.254.0.0/16 ridentifier 1000000102 label "Block IPv4 link-local" #--------------------------------------------------------------------------- # default deny rules #--------------------------------------------------------------------------- block in log inet all ridentifier 1000000103 label "Default deny rule IPv4" block out log inet all ridentifier 1000000104 label "Default deny rule IPv4" block in log inet6 all ridentifier 1000000105 label "Default deny rule IPv6" block out log inet6 all ridentifier 1000000106 label "Default deny rule IPv6" # IPv6 ICMP is not auxiliary, it is required for operation # See man icmp6(4) # 1 unreach Destination unreachable # 2 toobig Packet too big # 128 echoreq Echo service request # 129 echorep Echo service reply # 133 routersol Router solicitation # 134 routeradv Router advertisement # 135 neighbrsol Neighbor solicitation # 136 neighbradv Neighbor advertisement pass quick inet6 proto ipv6-icmp from any to any icmp6-type {1,2,135,136} ridentifier 1000000107 keep state # Allow only bare essential icmpv6 packets (NS, NA, and RA, echoreq, echorep) pass out quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type {129,133,134,135,136} ridentifier 1000000108 keep state pass out quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type {129,133,134,135,136} ridentifier 1000000109 keep state pass in quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type {128,133,134,135,136} ridentifier 1000000110 keep state pass in quick inet6 proto ipv6-icmp from ff02::/16 to fe80::/10 icmp6-type {128,133,134,135,136} ridentifier 1000000111 keep state pass in quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type {128,133,134,135,136} ridentifier 1000000112 keep state pass in quick inet6 proto ipv6-icmp from :: to ff02::/16 icmp6-type {128,133,134,135,136} ridentifier 1000000113 keep state # We use the mighty pf, we cannot be fooled. block log quick inet proto { tcp, udp } from any port = 0 to any ridentifier 1000000114 label "Block traffic from port 0" block log quick inet proto { tcp, udp } from any to any port = 0 ridentifier 1000000115 label "Block traffic to port 0" block log quick inet6 proto { tcp, udp } from any port = 0 to any ridentifier 1000000116 label "Block traffic from port 0" block log quick inet6 proto { tcp, udp } from any to any port = 0 ridentifier 1000000117 label "Block traffic to port 0" # Snort package block log quick from to any ridentifier 1000000118 label "Block snort2c hosts" block log quick from any to ridentifier 1000000119 label "Block snort2c hosts" # SSH lockout block in log quick proto tcp from to (self) port 22 ridentifier 1000000301 label "sshguard" # webConfigurator lockout block in log quick proto tcp from to (self) port 443 ridentifier 1000000351 label "GUI Lockout" block in log quick from to any ridentifier 1000000400 label "virusprot overload table" # allow our DHCP client out to the PUBLIC_IP_DMZ pass in quick on $PUBLIC_IP_DMZ proto udp from any port = 67 to any port = 68 ridentifier 1000000461 label "allow dhcp replies in PUBLIC_IP_DMZ" pass out quick on $PUBLIC_IP_DMZ proto udp from any port = 68 to any port = 67 ridentifier 1000000462 label "allow dhcp client out PUBLIC_IP_DMZ" # Not installing DHCP server firewall rules for PUBLIC_IP_DMZ which is configured for DHCP. # block bogon networks (IPv4) # https://www.team-cymru.org/Services/Bogons/bogon-bn-nonagg.txt block in log quick on $PUBLIC_IP_DMZ from to any ridentifier 11001 label "block bogon IPv4 networks from PUBLIC_IP_DMZ" # block bogon networks (IPv6) # https://www.team-cymru.org/Services/Bogons/fullbogons-ipv6.txt block in log quick on $PUBLIC_IP_DMZ from to any ridentifier 11002 label "block bogon IPv6 networks from PUBLIC_IP_DMZ" antispoof log for $PUBLIC_IP_DMZ ridentifier 1000001470 antispoof log for $ADMIN_LAN ridentifier 1000002520 antispoof log for $SERVERS_LAN ridentifier 1000003570 # loopback pass in on $loopback inet all ridentifier 1000004661 label "pass IPv4 loopback" pass out on $loopback inet all ridentifier 1000004662 label "pass IPv4 loopback" pass in on $loopback inet6 all ridentifier 1000004663 label "pass IPv6 loopback" pass out on $loopback inet6 all ridentifier 1000004664 label "pass IPv6 loopback" # let out anything from the firewall host itself and decrypted IPsec traffic pass out inet all keep state allow-opts ridentifier 1000004665 label "let out anything IPv4 from firewall host itself" pass out inet6 all keep state allow-opts ridentifier 1000004666 label "let out anything IPv6 from firewall host itself" pass out route-to ( vmx0 REDACTED ) from REDACTED to !REDACTED ridentifier 1000004761 keep state allow-opts label "let out anything from firewall host itself" # make sure the user cannot lock himself out of the webConfigurator or SSH pass in quick on vmx1 proto tcp from any to (vmx1) port { 443 80 22 } ridentifier 10001 keep state label "anti-lockout rule" # User-defined rules follow anchor "userrules/*" pass quick on { vmx1 vmx2 } inet proto icmp from any to $pfB_DNSBL_VIPs icmp-type echoreq ridentifier 1770001239 keep state label "USER_RULE: pfB_DNSBL_Ping auto rule" label "id:1770001239" pass quick on { vmx1 vmx2 } inet6 proto ipv6-icmp from any to $pfB_DNSBL_VIPs icmp6-type echoreq ridentifier 1770001239 keep state label "USER_RULE: pfB_DNSBL_Ping auto rule" label "id:1770001239" pass quick on { vmx1 vmx2 } inet proto { tcp udp } from any to $pfB_DNSBL_VIPs port $pfB_DNSBL_Ports ridentifier 1770001466 keep state label "USER_RULE: pfB_DNSBL_Permit auto rule" label "id:1770001466" pass quick on { vmx1 vmx2 } inet6 proto { tcp udp } from any to $pfB_DNSBL_VIPs port $pfB_DNSBL_Ports ridentifier 1770001466 keep state label "USER_RULE: pfB_DNSBL_Permit auto rule" label "id:1770001466" block log quick on { vmx0 } inet from $pfB_Top_v4 to any ridentifier 1770008794 label "USER_RULE: pfB_Top_v4 auto rule" label "id:1770008794" block log quick on { vmx0 } inet6 from $pfB_Top_v6 to any ridentifier 1770008690 label "USER_RULE: pfB_Top_v6 auto rule" label "id:1770008690" block log quick on { vmx0 } inet from $pfB_Asia_v4 to any ridentifier 1770008869 label "USER_RULE: pfB_Asia_v4 auto rule" label "id:1770008869" block log quick on { vmx0 } inet6 from $pfB_Asia_v6 to any ridentifier 1770008765 label "USER_RULE: pfB_Asia_v6 auto rule" label "id:1770008765" block log quick on { vmx0 } inet from $pfB_Europe_v4 to any ridentifier 1770009111 label "USER_RULE: pfB_Europe_v4 auto rule" label "id:1770009111" block log quick on { vmx0 } inet6 from $pfB_Europe_v6 to any ridentifier 1770009007 label "USER_RULE: pfB_Europe_v6 auto rule" label "id:1770009007" block log quick on { vmx0 } inet from $pfB_PS_v4 to any ridentifier 1770008650 label "USER_RULE: pfB_PS_v4 auto rule" label "id:1770008650" block log quick on { vmx0 } inet6 from $pfB_PS_v6 to any ridentifier 1770008546 label "USER_RULE: pfB_PS_v6 auto rule" label "id:1770008546" block log quick on { vmx0 } inet from $pfB_Homeworld_ASN_v4 to any ridentifier 1770009753 label "USER_RULE: pfB_Homeworld_ASN_v4 auto rule" label "id:1770009753" block log quick on { vmx0 } inet6 from $pfB_PRI1_6_v6 to any ridentifier 1770009375 label "USER_RULE: pfB_PRI1_6_v6 auto rule" label "id:1770009375" pass log quick on { vmx0 vmx1 vmx2 } inet from any to $pfB_DoH_IP_v4 ridentifier 1770004962 keep state label "USER_RULE: pfB_DoH_IP_v4 auto rule" label "id:1770004962" pass log quick on { vmx0 vmx1 vmx2 } inet from any to $pfB_Internic_4_v4 ridentifier 1770005830 keep state label "USER_RULE: pfB_Internic_4_v4 auto rule" label "id:1770005830" pass log quick on { vmx0 vmx1 vmx2 } inet6 from any to $pfB_Internic_6_v6 ridentifier 1770005622 keep state label "USER_RULE: pfB_Internic_6_v6 auto rule" label "id:1770005622" block return log quick on { vmx0 vmx1 vmx2 } inet from any to $pfB_Top_v4 ridentifier 1770004545 label "USER_RULE: pfB_Top_v4 auto rule" label "id:1770004545" block return log quick on { vmx0 vmx1 vmx2 } inet6 from any to $pfB_Top_v6 ridentifier 1770004441 label "USER_RULE: pfB_Top_v6 auto rule" label "id:1770004441" block return log quick on { vmx0 vmx1 vmx2 } inet from any to $pfB_Asia_v4 ridentifier 1770004620 label "USER_RULE: pfB_Asia_v4 auto rule" label "id:1770004620" block return log quick on { vmx0 vmx1 vmx2 } inet6 from any to $pfB_Asia_v6 ridentifier 1770004516 label "USER_RULE: pfB_Asia_v6 auto rule" label "id:1770004516" block return log quick on { vmx0 vmx1 vmx2 } inet from any to $pfB_Europe_v4 ridentifier 1770004862 label "USER_RULE: pfB_Europe_v4 auto rule" label "id:1770004862" block return log quick on { vmx0 vmx1 vmx2 } inet6 from any to $pfB_Europe_v6 ridentifier 1770004758 label "USER_RULE: pfB_Europe_v6 auto rule" label "id:1770004758" block return log quick on { vmx0 vmx1 vmx2 } inet from any to $pfB_PRI1_v4 ridentifier 1770004795 label "USER_RULE: pfB_PRI1_v4 auto rule" label "id:1770004795" block return log quick on { vmx0 vmx1 vmx2 } inet from any to $pfB_PRI2_v4 ridentifier 1770004819 label "USER_RULE: pfB_PRI2_v4 auto rule" label "id:1770004819" block return log quick on { vmx0 vmx1 vmx2 } inet from any to $pfB_SCANNERS_v4 ridentifier 1770004843 label "USER_RULE: pfB_SCANNERS_v4 auto rule" label "id:1770004843" block return log quick on { vmx0 vmx1 vmx2 } inet from any to $pfB_Homeworld_ASN_v4 ridentifier 1770005504 label "USER_RULE: pfB_Homeworld_ASN_v4 auto rule" label "id:1770005504" block return log quick on { vmx0 vmx1 vmx2 } inet6 from any to $pfB_PRI1_6_v6 ridentifier 1770005126 label "USER_RULE: pfB_PRI1_6_v6 auto rule" label "id:1770005126" block return log quick on { vmx0 vmx1 vmx2 } inet6 from any to $pfB_DoH_6_v6 ridentifier 1770004820 label "USER_RULE: pfB_DoH_6_v6 auto rule" label "id:1770004820" pass in quick on $PUBLIC_IP_DMZ reply-to ( vmx0 REDACTED ) inet proto udp from $Nokia to $Graylog port 1517 ridentifier 1689123391 keep state label "USER_RULE: NAT Forward Nokia syslog to Graylog" label "id:1689123391" block in quick on $PUBLIC_IP_DMZ reply-to ( vmx0 REDACTED ) inet from $RFC1918 to any ridentifier 1689123770 label "USER_RULE: Deny RFC 1918" label "id:1689123770" pass in quick on $ADMIN_LAN inet from 192.168.0.0/24 to any ridentifier 0100000101 keep state label "USER_RULE: Default allow LAN to any rule" label "id:0100000101" # source address is empty. label "USER_RULE: Default allow LAN IPv6 to any rule" pass in quick on $SERVERS_LAN inet proto { tcp udp } from any to 192.168.7.10 port 53 ridentifier 1689108958 keep state label "USER_RULE: Allow DNS to Chimera" label "id:1689108958" pass in quick on $SERVERS_LAN inet from 192.168.7.0/24 to any ridentifier 1689110922 keep state label "USER_RULE: Default allow LAN to any rule" label "id:1689110922" # source address is empty. label "USER_RULE: Default allow LAN IPv6 to any rule" # VPN Rules anchor "tftp-proxy/*"