mirror of
https://github.com/fwbuilder/fwbuilder
synced 2026-03-20 10:17:16 +01:00
344a22feed
compiler for PF does not need to generate protocol match "proto {tcp
udp icmp}" when service object used in the NAT rule is "any". The
reason this was done this way is lost in the mist of time; it's been
like this since very early versions of fwbuilder.
42 lines
965 B
Plaintext
42 lines
965 B
Plaintext
|
|
|
|
#
|
|
# Scrub rules
|
|
#
|
|
scrub in all fragment reassemble
|
|
|
|
#
|
|
# Rule 1 (NAT)
|
|
nat on eth0 from 192.168.1.0/24 to any -> (eth0)
|
|
|
|
#
|
|
# Rule backup ssh access rule
|
|
# backup ssh access rule
|
|
pass in quick inet proto tcp from 192.168.1.100 to self port 22 keep state
|
|
#
|
|
# Rule 0 (enc0)
|
|
# This adds "pass out ... keep state"
|
|
# rule that compiler 2.1.14
|
|
# does not add automatically for pf 3.x
|
|
# Note that checkbox "add 'keep state'"
|
|
# is on in options
|
|
pass out quick on enc0 inet from any to any keep state
|
|
#
|
|
# Rule 1 (eth0)
|
|
pass in quick on eth0 inet proto tcp from 192.168.1.0/24 to any port { 80, 22 } keep state
|
|
#
|
|
# Rule 2 (lo0)
|
|
pass quick on lo0 inet from any to any
|
|
#
|
|
# Rule 3 (enc0)
|
|
# via ipsec
|
|
pass quick on enc0 inet proto tcp from 33.33.33.0/24 to 192.168.1.0/24 port 80 keep state
|
|
#
|
|
# Rule 4 (global)
|
|
block log quick inet from any to any
|
|
#
|
|
# Rule fallback rule
|
|
# fallback rule
|
|
block quick inet from any to any
|
|
|