Annotation of src/share/pf/faq-example1, Revision 1.3
1.3 ! joel 1: # $OpenBSD: faq-example1,v 1.2 2003/08/06 16:04:45 henning Exp $
1.1 henning 2:
3: #
4: # Firewall for Home or Small Office
1.2 henning 5: # http://www.openbsd.org/faq/pf/example1.html
1.1 henning 6: #
7:
8:
9: # macros
10: int_if = "fxp0"
11: ext_if = "ep0"
12:
13: tcp_services = "{ 22, 113 }"
14: icmp_types = "echoreq"
15:
16: priv_nets = "{ 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8 }"
1.3 ! joel 17:
! 18: comp3 = "192.168.0.3"
! 19:
1.1 henning 20: # options
21: set block-policy return
22: set loginterface $ext_if
23:
24: # scrub
25: scrub in all
26:
27: # nat/rdr
28: nat on $ext_if from $int_if:network to any -> ($ext_if)
29: rdr on $int_if proto tcp from any to any port 21 -> 127.0.0.1 \
30: port 8021
1.3 ! joel 31: rdr on $ext_if proto tcp from any to any port 80 -> $comp3
1.1 henning 32:
33: # filter rules
34: block all
35:
36: pass quick on lo0 all
37:
38: block drop in quick on $ext_if from $priv_nets to any
39: block drop out quick on $ext_if from any to $priv_nets
40:
41: pass in on $ext_if inet proto tcp from any to ($ext_if) \
42: port $tcp_services flags S/SA keep state
1.3 ! joel 43:
! 44: pass in on $ext_if proto tcp from any to $comp3 port 80 \
! 45: flags S/SA synproxy state
! 46:
! 47: pass in on $ext_if inet proto tcp from port 20 to ($ext_if) \
! 48: user proxy flags S/SA keep state
1.1 henning 49:
50: pass in inet proto icmp all icmp-type $icmp_types keep state
51:
52: pass in on $int_if from $int_if:network to any keep state
53: pass out on $int_if from any to $int_if:network keep state
54:
55: pass out on $ext_if proto tcp all modulate state flags S/SA
56: pass out on $ext_if proto { udp, icmp } all keep state