mirror of
https://github.com/fwbuilder/fwbuilder
synced 2025-10-16 07:28:25 +02:00
6a9fdbf3af
should use "(interface)" syntax to the right of "->" in NAT rules. This now works for all interfaces, including those that have ip addresses in fwbuilder configuration, when interface object appears in "Translated Source" in a nat rule. When firewall object appears in "Translated Source", it gets replaced with a set of its interfaces which also get translated into "-> (interface)".
94 lines
2.8 KiB
Plaintext
94 lines
2.8 KiB
Plaintext
|
|
set optimization high-latency
|
|
|
|
|
|
|
|
# Tables: (3)
|
|
table <tbl.r2> { eth1 , 192.168.1.1 , 192.168.2.1 , 222.222.222.222 }
|
|
table <tbl.r4.s> { self , 192.168.1.0/24 }
|
|
table <tbl.r6.s> { 192.168.1.10 , 192.168.1.20 }
|
|
|
|
|
|
#
|
|
# Prolog script
|
|
#
|
|
# prolog commands go after table definitions
|
|
|
|
#
|
|
# End of prolog script
|
|
#
|
|
#
|
|
# Rule 0 (NAT)
|
|
nat on eth0 proto {tcp udp icmp} from 192.168.1.10 to any -> (eth0)
|
|
nat on eth1 proto {tcp udp icmp} from 192.168.1.10 to any -> (eth1)
|
|
nat on eth2 proto {tcp udp icmp} from 192.168.1.10 to any -> (eth2)
|
|
nat on eth3 proto {tcp udp icmp} from 192.168.1.10 to any -> (eth3)
|
|
#
|
|
# Rule 1 (NAT)
|
|
nat on eth0 proto {tcp udp icmp} from 192.168.1.0/24 to ! 192.168.2.0/24 -> (eth0)
|
|
nat on eth1 proto {tcp udp icmp} from 192.168.1.0/24 to ! 192.168.2.0/24 -> (eth1)
|
|
nat on eth2 proto {tcp udp icmp} from 192.168.1.0/24 to ! 192.168.2.0/24 -> (eth2)
|
|
nat on eth3 proto {tcp udp icmp} from 192.168.1.0/24 to ! 192.168.2.0/24 -> (eth3)
|
|
#
|
|
# Rule 2 (NAT)
|
|
rdr proto tcp from any to <tbl.r2> port 22 -> 192.168.1.10 port 22
|
|
#
|
|
# Rule 3 (NAT)
|
|
# SDNAT rule
|
|
rdr on eth3 proto tcp from 192.168.1.0/24 to 222.222.222.222 port 80 -> 192.168.1.10 port 80
|
|
nat on eth0 proto tcp from 192.168.1.0/24 to 192.168.1.10 port 80 -> (eth0)
|
|
#
|
|
# Rule 4 (NAT)
|
|
nat on eth3 proto {tcp udp icmp} from 192.168.1.0/24 to any -> (eth3)
|
|
#
|
|
# Rule 5 (NAT)
|
|
# eth1 is dynamic
|
|
nat on eth1 proto tcp from 192.168.1.0/24 to any port 22 -> (eth1)
|
|
|
|
# Policy compiler errors and warnings:
|
|
# firewall4:Policy:6: warning: Changing rule direction due to self reference
|
|
#
|
|
# Rule 0 (global)
|
|
anchor "ftp-proxy/*" inet from any to any
|
|
#
|
|
# Rule 1 (global)
|
|
pass log quick inet proto tcp from any to (eth1) port 22 keep state
|
|
#
|
|
# Rule 2 (eth1)
|
|
block log quick on eth1 inet proto icmp from ! 192.168.2.0/24 to any icmp-type 8 code 0
|
|
#
|
|
# Rule 3 (eth1)
|
|
# Anti-spoofing rule
|
|
block in log quick on eth1 inet from self to any
|
|
block in log quick on eth1 inet from 192.168.1.0/24 to any
|
|
#
|
|
# Rule 4 (eth1)
|
|
# Anti-spoofing rule
|
|
block out log quick on eth1 inet from ! <tbl.r4.s> to any
|
|
#
|
|
# Rule 5 (global)
|
|
# hostF has the same IP address as firewal.
|
|
pass log quick inet proto icmp from any to 192.168.1.1 icmp-type 8 code 0 keep state
|
|
#
|
|
# Rule 6 (global)
|
|
# firewall4:Policy:6: warning: Changing rule direction due to self reference
|
|
|
|
block in log quick inet proto icmp from ! <tbl.r6.s> to self icmp-type 3
|
|
#
|
|
# Rule 7 (global)
|
|
# testing negation in the policy rule
|
|
block log quick inet proto icmp from ! <tbl.r6.s> to any icmp-type 3
|
|
#
|
|
# Rule 9 (global)
|
|
# 'masquerading' rule
|
|
pass quick inet from 192.168.1.0/24 to any keep state
|
|
#
|
|
# Rule 10 (global)
|
|
# 'catch all' rule
|
|
block log quick inet from any to any
|
|
#
|
|
# Rule fallback rule
|
|
# fallback rule
|
|
block quick inet from any to any
|
|
|