Annotation of src/share/pf/faq-example1, Revision 1.2
1.2 ! henning 1: # $OpenBSD: faq-example1,v 1.1 2003/08/02 18:25:49 henning Exp $
1.1 henning 2:
3: #
4: # Firewall for Home or Small Office
1.2 ! henning 5: # http://www.openbsd.org/faq/pf/example1.html
1.1 henning 6: #
7:
8:
9: # macros
10: int_if = "fxp0"
11: ext_if = "ep0"
12:
13: tcp_services = "{ 22, 113 }"
14: icmp_types = "echoreq"
15:
16: priv_nets = "{ 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8 }"
17:
18: # options
19: set block-policy return
20: set loginterface $ext_if
21:
22: # scrub
23: scrub in all
24:
25: # nat/rdr
26: nat on $ext_if from $int_if:network to any -> ($ext_if)
27: rdr on $int_if proto tcp from any to any port 21 -> 127.0.0.1 \
28: port 8021
29:
30: # filter rules
31: block all
32:
33: pass quick on lo0 all
34:
35: block drop in quick on $ext_if from $priv_nets to any
36: block drop out quick on $ext_if from any to $priv_nets
37:
38: pass in on $ext_if inet proto tcp from any to ($ext_if) \
39: port $tcp_services flags S/SA keep state
40:
41: pass in inet proto icmp all icmp-type $icmp_types keep state
42:
43: pass in on $int_if from $int_if:network to any keep state
44: pass out on $int_if from any to $int_if:network keep state
45:
46: pass out on $ext_if proto tcp all modulate state flags S/SA
47: pass out on $ext_if proto { udp, icmp } all keep state