set limit { frags 5000, states 10000 } set optimization aggressive set timeout tcp.first 5 set timeout tcp.opening 5 set timeout tcp.established 10 # # Prolog script # # prolog # prolog commands go after set commands # # End of prolog script # # # Scrub rules # scrub in all fragment reassemble no-df scrub out all random-id min-ttl 32 max-mss 1460 # Tables: (4) table { 192.168.1.10 , 192.168.1.20 } table { eth4 , 22.22.22.22 , 22.22.23.23 , 192.168.1.1 , 192.168.2.1 } table { 192.168.1.0/24 , 192.168.2.0/24 } table { self , 192.168.1.0/24 } # # Rule 0 (NAT) nat on eth0 proto {tcp udp icmp} from 192.168.1.0/24 to any -> (eth0) nat on eth1 proto {tcp udp icmp} from 192.168.1.0/24 to any -> (eth1) nat on eth3 proto {tcp udp icmp} from 192.168.1.0/24 to any -> (eth3) nat on eth2 proto {tcp udp icmp} from 192.168.1.0/24 to any -> (eth2) nat on eth4 proto {tcp udp icmp} from 192.168.1.0/24 to any -> (eth4) # # Rule 1 (NAT) nat proto {tcp udp icmp} from to any -> 22.22.22.23 # # Rule 2 (NAT) nat proto {tcp udp icmp} from 192.168.1.0/24 to -> 192.168.1.1 # # Rule 3 (NAT) nat on eth0 proto tcp from 192.168.1.0/24 to any port 80 -> (eth0) nat on eth1 proto tcp from 192.168.1.0/24 to any port 80 -> (eth1) nat on eth3 proto tcp from 192.168.1.0/24 to any port 80 -> (eth3) nat on eth2 proto tcp from 192.168.1.0/24 to any port 80 -> (eth2) nat on eth4 proto tcp from 192.168.1.0/24 to any port 80 -> (eth4) # # Rule 4 (NAT) nat proto tcp from to any port 80 -> 22.22.22.23 # # Rule 5 (NAT) nat proto tcp from 192.168.1.0/24 to port 80 -> 192.168.1.1 # # Rule 6 (NAT) nat on eth0 proto 47 from 192.168.1.0/24 to any -> (eth0) nat on eth1 proto 47 from 192.168.1.0/24 to any -> (eth1) nat on eth3 proto 47 from 192.168.1.0/24 to any -> (eth3) nat on eth2 proto 47 from 192.168.1.0/24 to any -> (eth2) nat on eth4 proto 47 from 192.168.1.0/24 to any -> (eth4) # # Rule 7 (NAT) nat proto icmp from to any -> 22.22.22.23 # # Rule 8 (NAT) nat proto udp from 192.168.1.0/24 to port 53 -> 192.168.1.1 # # Rule 9 (NAT) rdr proto {tcp udp icmp} from any to 22.22.22.23 -> 192.168.1.10 # # Rule 10 (NAT) rdr proto tcp from any to 22.22.22.23 port 80 -> 192.168.1.10 port 80 rdr proto tcp from any to 22.22.22.23 port 119 -> 192.168.1.10 port 119 # # Rule 11 (NAT) rdr proto tcp from any to 22.22.22.22 port 119 -> 192.168.1.10 port 119 # # Rule 12 (NAT) nat proto {tcp udp icmp} from 192.168.1.20 to any -> 22.22.23.24 # # Rule 16 (NAT) rdr proto {tcp udp icmp} from any to -> 192.168.1.10 # # Rule 17 (NAT) rdr on eth1 proto {tcp udp icmp} from any to 22.22.22.22 -> 192.168.1.10 # # Rule 18 (NAT) rdr on eth1 proto {tcp udp icmp} from any to 22.22.22.22 -> 192.168.1.10 # # Rule 19 (NAT) rdr proto 47 from any to -> 192.168.1.10 # # Rule 20 (NAT) rdr proto tcp from any to port 10000:11000 -> 192.168.1.10 port 10000:* # # Rule 21 (NAT) rdr on eth1 proto tcp from any to 22.22.22.22 port 10000:11000 -> 192.168.1.10 port 10000:* # # Rule 22 (NAT) rdr on eth1 proto tcp from any to 22.22.22.22 port 10000:11000 -> 192.168.1.10 port 10000:* # # Rule 23 (NAT) rdr on eth1 proto tcp from any to 22.22.22.22 port 10000:11000 -> 192.168.1.10 port 10000:* nat on eth0 proto tcp from any to 192.168.1.10 port 10000:11000 -> 192.168.1.1 # # Rule 24 (NAT) rdr proto tcp from any to 22.22.22.23 port 80 -> 192.168.1.10 port 25 # # Rule 25 (NAT) rdr proto tcp from 192.168.1.0/24 to any port 80 -> 127.0.0.1 port 80 # # Rule 26 (NAT) rdr proto tcp from 192.168.1.0/24 to any port 80 -> (eth0) port 80 # # Rule 27 (NAT) rdr proto tcp from any to port 1080 -> 127.0.0.1 port 80 # # Rule 28 (NAT) # SF bug 3162862 rdr proto tcp from 192.168.1.0/24 to ! 192.168.1.0/24 port 80 -> 192.168.1.10 port 10000:* # # Rule 29 (NAT) # SF bug 3162862 rdr proto tcp from 192.168.1.0/24 to ! port 80 -> 192.168.1.10 port 10000:* # # Rule 30 (NAT) # SF bug 3162862 rdr proto tcp from 192.168.1.0/24 to ! port 80 -> 127.0.0.1 port 10000:* # # Rule 31 (NAT) # for bug 1111267: this custom service object has # "proto ..." in the protocol string, compiler can put # it in generated nat command in the right place. nat on eth1 proto {tcp udp icmp gre} from 192.168.1.0/24 to any -> 22.22.22.22 # # Rule 32 (NAT) # for bug 1111267: this custom service object # has "proto .." in the code string but we can't insert # it in the generated nat command b/c it would appear # in the wrong place, after "from". nat on eth1 from 192.168.1.0/24 to any -> 22.22.22.22 # # Rule 33 (NAT) nat on eth1 proto tcp from 192.168.1.0/24 to any -> 22.22.22.22 nat on eth1 proto udp from 192.168.1.0/24 to any -> 22.22.22.22 nat on eth1 proto 47 from 192.168.1.0/24 to any -> 22.22.22.22 nat on eth1 proto icmp from 192.168.1.0/24 to any -> 22.22.22.22 # # Rule 34 (NAT) nat on eth0 proto tcp from 192.168.1.0/24 to any port 80 -> (eth0) # # Rule 35 (NAT) nat on eth4 proto tcp from 192.168.1.0/24 to any port 80 -> (eth4) # # Rule 36 (NAT) rdr proto tcp from any to 22.22.22.22 port 119 -> { 192.168.1.10 , 255.255.255.255 } port 119 # # Rule 37 (NAT) rdr on eth1 proto tcp from any to (eth1) port 119 -> { 192.168.1.10 , 255.255.255.255 } port 119 round-robin # Policy compiler errors and warnings: # firewall2:Policy:12: warning: Changing rule direction due to self reference # # Rule backup ssh access rule # backup ssh access rule pass in quick inet proto tcp from 192.168.1.100 to self port 22 keep state label "RULE -1 - ACCEPT **" # # Rule 0 (eth0) block in log quick on eth0 inet from ! 192.168.1.0/24 to any label "RULE 0 - DROP **" # # Rule 1 (eth1) # Anti-spoofing rule block in log quick on eth1 inet from self to any label "Iface: eth1 RULE 1 -- DROP **" block in log quick on eth1 inet from 192.168.1.0/24 to any label "Iface: eth1 RULE 1 -- DROP **" # # Rule 2 (f2i1,3) # rules 2,3,4 test group # usage in interface # all three rules should yield # the same config block in log quick on { eth1 eth3 } inet from self to any label "Iface: eth1 eth3 RULE 2 -- DROP **" block in log quick on { eth1 eth3 } inet from 192.168.1.0/24 to any label "Iface: eth1 eth3 RULE 2 -- DROP **" # # Rule 3 (f2i1,eth3) # Anti-spoofing rule block in log quick on { eth1 eth3 } inet from self to any label "Iface: eth1 eth3 RULE 3 -- DROP **" block in log quick on { eth1 eth3 } inet from 192.168.1.0/24 to any label "Iface: eth1 eth3 RULE 3 -- DROP **" # # Rule 4 (eth1,eth3) # Anti-spoofing rule block in log quick on { eth1 eth3 } inet from self to any label "Iface: eth1 eth3 RULE 4 -- DROP **" block in log quick on { eth1 eth3 } inet from 192.168.1.0/24 to any label "Iface: eth1 eth3 RULE 4 -- DROP **" # # Rule 5 (eth1) # Anti-spoofing rule block out log quick on eth1 inet from ! to any label "Iface: eth1 RULE 5 -- DROP **" # # Rule 6 (global) # block fragments block log quick inet from any to any fragment label "RULE 6 - DROP **" # # Rule 7 (global) # sends TCP RST and makes custom record in the log block return-rst log quick inet proto tcp from any to any port 113 label "IDENT" # # Rule 8 (global) pass quick inet from to 200.200.200.200 keep state label "RULE 8 - ACCEPT **" # # Rule 9 (global) pass quick inet from 200.200.200.200 to keep state label "RULE 9 - ACCEPT **" # # Rule 10 (global) # 'masquerading' rule pass quick inet from 192.168.1.0/24 to any keep state label "RULE 10 - ACCEPT **" # # Rule 12 (global) # firewall2:Policy:12: warning: Changing rule direction due to self reference pass in quick inet proto tcp from any to self port { 21, 80, 25 } keep state label "RULE 12 - ACCEPT **" pass quick inet proto tcp from any to 192.168.1.10 port { 21, 80, 25 } keep state label "RULE 12 - ACCEPT **" # # Rule 13 (global) # 'catch all' rule block log quick inet from any to any label "RULE 13 - DROP **" # # Rule fallback rule # fallback rule block quick inet from any to any label "RULE 10000 - DROP **"