mirror of
https://github.com/fwbuilder/fwbuilder
synced 2026-05-02 23:27:30 +02:00
6a9fdbf3af
should use "(interface)" syntax to the right of "->" in NAT rules. This now works for all interfaces, including those that have ip addresses in fwbuilder configuration, when interface object appears in "Translated Source" in a nat rule. When firewall object appears in "Translated Source", it gets replaced with a set of its interfaces which also get translated into "-> (interface)".
38 lines
1.1 KiB
Plaintext
38 lines
1.1 KiB
Plaintext
|
|
|
|
|
|
#
|
|
# Rule 0 (NAT)
|
|
# Translate source address
|
|
# for outgoing connections
|
|
nat on le1 proto {tcp udp icmp} from 192.168.1.0/24 to any -> (le1)
|
|
#
|
|
# Rule 1 (NAT)
|
|
# Translate source address
|
|
# for outgoing connections
|
|
nat on le2 proto {tcp udp icmp} from 192.168.1.0/24 to any -> (le2)
|
|
|
|
#
|
|
# Rule 0 (lo0)
|
|
pass quick on lo0 inet from any to any label "RULE 0 -- ACCEPT "
|
|
#
|
|
# Rule 1 (fxp0)
|
|
pass quick on fxp0 inet from 192.168.1.0/24 to 192.168.1.0/24 label "RULE 1 -- ACCEPT "
|
|
#
|
|
# Rule 2 (fxp0)
|
|
pass in quick on fxp0 route-to { ( le1 192.0.2.10 ) } inet proto tcp from 192.168.1.0/24 to any port { 80, 25 } label "RULE 2 -- ACCEPT "
|
|
#
|
|
# Rule 3 (fxp0)
|
|
pass in quick on fxp0 route-to { ( le2 192.0.3.10 ) } inet proto tcp from 192.168.1.0/24 to any port 22 label "RULE 3 -- ACCEPT "
|
|
#
|
|
# Rule 4 (global)
|
|
pass out quick inet from self to any keep state label "RULE 4 -- ACCEPT "
|
|
#
|
|
# Rule 5 (global)
|
|
block log quick inet from any to any label "RULE 5 -- DROP "
|
|
#
|
|
# Rule fallback rule
|
|
# fallback rule
|
|
block quick inet from any to any label "RULE 10000 -- DROP "
|
|
|