src/etc/pf.conf - diff

Return to pf.conf CVS log

Up to [local] / src / etc

version 1.6, 2002/06/27 07:00:43

version 1.7, 2002/11/16 12:55:22

Line 1

# $OpenBSD$

# See pf.conf(5) for syntax and examples

# General order: options, scrub rules, NAT/rdr, and filter rules.

# Note that NAT is first match while packet filters are last match,

# replace ext0 with external interface name, 10.0.0.0/8 with internal network

ext_if=ext0 # replace with actual external interface name i.e., dc0

# and 192.168.1.1 with external address

internal_net=10.1.1.1/8

external_addr=192.168.1.1

# Normalize: reassemble fragments and resolve or reduce traffic ambiguities

# scrub in all

# nat: packets going out through ext0 with source address 10.0.0.0/8 will get

# nat: packets going out through $ext_if with source address $internal_net will get

# translated as coming from 192.168.1.1. a state is created for such packets,

# translated as coming from $external_addr, a state is created for such packets,

# and incoming packets will be redirected to the internal address.

# nat on ext0 from 10.0.0.0/8 to any -> 192.168.1.1

# nat on $ext_if from $internal_net to any -> $external_addr

# rdr: packets coming in through ext0 with destination 192.168.1.1:1234 will

# rdr: packets coming in on $ext_if with destination $external_addr:1234 will

# be redirected to 10.1.1.1:5678. a state is created for such packets, and

# be redirected to 10.1.1.1:5678. A state is created for such packets, and

# outgoing packets will be translated as coming from the external address.

# rdr on ext0 proto tcp from any to 192.168.1.1/32 port 1234 -> 10.1.1.1 port 5678

# rdr on $ext_if proto tcp from any to $external_addr/32 port 1234 -> 10.1.1.1 port 5678

# filter rules

# the implicit first two rules are

Line 31

Line 33

# log blocked packets

# block in log all

# pass in on ext0 proto tcp from any to ext0 port 22 keep state

# pass in on $ext_if proto tcp from any to $ext_if port 22 keep state

# pass out on ext0 proto { tcp, udp } all keep state

# pass out on $ext_if proto { tcp, udp } all keep state