mirror of
https://github.com/fwbuilder/fwbuilder
synced 2025-10-17 07:57:43 +02:00
6e0654aaa6
use create_args_carp0 instead of ifconfig_carp0 to set up CARP interface vhid, pass and adskew parameters.
127 lines
6.0 KiB
Plaintext
127 lines
6.0 KiB
Plaintext
|
|
|
|
|
|
|
|
# Tables: (5)
|
|
table <tbl.r4.s> { 222.222.222.22 , 222.222.222.23 }
|
|
table <tbl.r4.sx> { 2001:5c0:0:2::24 , 3ffe:1200:2000::/36 , 3ffe:1200:2001:1:8000::1 }
|
|
table <tbl.r5.s> { 61.150.47.112 , 74.125.224.112 , 74.125.224.113 , 74.125.224.114 , 74.125.224.115 , 74.125.224.116 , 192.168.1.0 }
|
|
table <tbl.r5.sx> { 2001:5c0:0:2::24 , 3ffe:1200:2001:1:8000::1 }
|
|
table <tbl.r7.s> { 61.150.47.112 , 192.168.1.0 }
|
|
|
|
# Policy compiler errors and warnings:
|
|
# firewall-ipv6-2:Policy:5: error: Rule '5 (global)' shadows rule '7 (global)' below it
|
|
# firewall-ipv6-2:Policy:5: error: Rule '5 (global)' shadows rule '7 (global)' below it
|
|
# firewall-ipv6-2:Policy:7: warning: Changing rule direction due to self reference
|
|
#
|
|
# Rule 0 (lo)
|
|
pass quick on lo inet from any to any keep state label "RULE 0 -- ACCEPT "
|
|
#
|
|
# Rule 4 (global)
|
|
pass log quick inet proto tcp from <tbl.r4.s> to 1.1.1.1 port 22 keep state label "RULE 4 -- ACCEPT "
|
|
#
|
|
# Rule 5 (global)
|
|
# firewall-ipv6-2:Policy:5: error: Rule '5 (global)' shadows rule '7 (global)' below it
|
|
|
|
pass log quick inet proto tcp from <tbl.r5.s> to 1.1.1.1 port 22 keep state label "RULE 5 -- ACCEPT "
|
|
#
|
|
# Rule 7 (global)
|
|
# firewall-ipv6-2:Policy:7: warning: Changing rule direction due to self reference
|
|
|
|
pass in log quick inet proto tcp from <tbl.r7.s> to self port 22 keep state label "RULE 7 -- ACCEPT "
|
|
#
|
|
# Rule 8 (global)
|
|
pass in log quick inet from any to self keep state label "RULE 8 -- ACCEPT "
|
|
#
|
|
# Rule 11 (global)
|
|
pass log quick inet from <tbl.r7.s> to any keep state label "RULE 11 -- ACCEPT "
|
|
#
|
|
# Rule 12 (global)
|
|
pass quick inet proto icmp from any to any icmp-type 8 code 0 keep state label "RULE 12 -- ACCEPT "
|
|
#
|
|
# Rule fallback rule
|
|
# fallback rule
|
|
block quick inet from any to any label "RULE 10000 -- DROP "
|
|
|
|
# Policy compiler errors and warnings:
|
|
# firewall-ipv6-2:Policy:2: error: Rule '2 (global)' shadows rule '4 (global)' below it
|
|
# firewall-ipv6-2:Policy:3: error: Rule '3 (global)' shadows rule '4 (global)' below it
|
|
# firewall-ipv6-2:Policy:2: error: Rule '2 (global)' shadows rule '5 (global)' below it
|
|
# firewall-ipv6-2:Policy:3: error: Rule '3 (global)' shadows rule '5 (global)' below it
|
|
# firewall-ipv6-2:Policy:2: error: Rule '2 (global)' shadows rule '6 (global)' below it
|
|
# firewall-ipv6-2:Policy:4: error: Rule '4 (global)' shadows rule '6 (global)' below it
|
|
# firewall-ipv6-2:Policy:3: error: Rule '3 (global)' shadows rule '6 (global)' below it
|
|
# firewall-ipv6-2:Policy:2: error: Rule '2 (global)' shadows rule '7 (global)' below it
|
|
# firewall-ipv6-2:Policy:3: error: Rule '3 (global)' shadows rule '7 (global)' below it
|
|
# firewall-ipv6-2:Policy:10: error: Rule '10 (global)' shadows rule '11 (global)' below it
|
|
# firewall-ipv6-2:Policy:10: error: Rule '10 (global)' shadows rule '11 (global)' below it
|
|
# firewall-ipv6-2:Policy:3: warning: Changing rule direction due to self reference
|
|
# firewall-ipv6-2:Policy:6: warning: Changing rule direction due to self reference
|
|
# firewall-ipv6-2:Policy:7: warning: Changing rule direction due to self reference
|
|
#
|
|
# Rule 0 (lo)
|
|
pass quick on lo inet6 from any to any keep state label "RULE 0 -- ACCEPT "
|
|
#
|
|
# Rule 1 (global)
|
|
# this rule shadows the next.
|
|
# Note that we add command line
|
|
# flag -xt to the compiler
|
|
pass quick inet6 proto tcp from fe80::/64 to fe80::21d:9ff:fe8b:8e94 port 22 keep state label "RULE 1 -- ACCEPT "
|
|
#
|
|
# Rule 2 (global)
|
|
# firewall-ipv6-2:Policy:2: error: Rule '2 (global)' shadows rule '4 (global)' below it
|
|
# firewall-ipv6-2:Policy:2: error: Rule '2 (global)' shadows rule '5 (global)' below it
|
|
# firewall-ipv6-2:Policy:2: error: Rule '2 (global)' shadows rule '6 (global)' below it
|
|
# firewall-ipv6-2:Policy:2: error: Rule '2 (global)' shadows rule '7 (global)' below it
|
|
|
|
pass quick inet6 proto tcp from 2001:5c0:0:2::24 to fe80::21d:9ff:fe8b:8e94 port 22 keep state label "RULE 2 -- ACCEPT "
|
|
#
|
|
# Rule 3 (global)
|
|
# firewall-ipv6-2:Policy:3: error: Rule '3 (global)' shadows rule '4 (global)' below it
|
|
# firewall-ipv6-2:Policy:3: error: Rule '3 (global)' shadows rule '5 (global)' below it
|
|
# firewall-ipv6-2:Policy:3: error: Rule '3 (global)' shadows rule '6 (global)' below it
|
|
# firewall-ipv6-2:Policy:3: error: Rule '3 (global)' shadows rule '7 (global)' below it
|
|
# firewall-ipv6-2:Policy:3: warning: Changing rule direction due to self reference
|
|
|
|
pass in log quick inet6 proto tcp from 3ffe:1200:2001:1:8000::1 to self port 22 keep state label "RULE 3 -- ACCEPT "
|
|
#
|
|
# Rule 4 (global)
|
|
# firewall-ipv6-2:Policy:4: error: Rule '4 (global)' shadows rule '6 (global)' below it
|
|
|
|
pass log quick inet6 proto tcp from <tbl.r4.sx> to fe80::21d:9ff:fe8b:8e94 port 22 keep state label "RULE 4 -- ACCEPT "
|
|
#
|
|
# Rule 5 (global)
|
|
pass log quick inet6 proto tcp from <tbl.r5.sx> to fe80::21d:9ff:fe8b:8e94 port 22 keep state label "RULE 5 -- ACCEPT "
|
|
#
|
|
# Rule 6 (global)
|
|
# firewall-ipv6-2:Policy:6: warning: Changing rule direction due to self reference
|
|
|
|
pass in log quick inet6 proto tcp from <tbl.r4.sx> to self port 22 keep state label "RULE 6 -- ACCEPT "
|
|
#
|
|
# Rule 7 (global)
|
|
# firewall-ipv6-2:Policy:7: warning: Changing rule direction due to self reference
|
|
|
|
pass in log quick inet6 proto tcp from <tbl.r5.sx> to self port 22 keep state label "RULE 7 -- ACCEPT "
|
|
#
|
|
# Rule 8 (global)
|
|
pass in log quick inet6 from any to self keep state label "RULE 8 -- ACCEPT "
|
|
#
|
|
# Rule 9 (global)
|
|
pass log quick inet6 from fe80::/64 to any keep state label "RULE 9 -- ACCEPT "
|
|
#
|
|
# Rule 10 (global)
|
|
# firewall-ipv6-2:Policy:10: error: Rule '10 (global)' shadows rule '11 (global)' below it
|
|
|
|
pass log quick inet6 from <tbl.r4.sx> to any keep state label "RULE 10 -- ACCEPT "
|
|
#
|
|
# Rule 11 (global)
|
|
pass log quick inet6 from <tbl.r5.sx> to any keep state label "RULE 11 -- ACCEPT "
|
|
#
|
|
# Rule 12 (global)
|
|
pass quick inet6 proto icmp6 from any to any keep state label "RULE 12 -- ACCEPT "
|
|
#
|
|
# Rule fallback rule
|
|
# fallback rule
|
|
block quick inet6 from any to any label "RULE 10000 -- DROP "
|
|
|