mirror of
https://github.com/fwbuilder/fwbuilder
synced 2026-03-19 17:57:22 +01:00
344a22feed
compiler for PF does not need to generate protocol match "proto {tcp
udp icmp}" when service object used in the NAT rule is "any". The
reason this was done this way is lost in the mist of time; it's been
like this since very early versions of fwbuilder.
76 lines
3.5 KiB
Plaintext
76 lines
3.5 KiB
Plaintext
|
|
|
|
|
|
#
|
|
# Rule 0 (NAT)
|
|
# Translate source address
|
|
# for outgoing connections
|
|
nat on le1 from 192.168.1.0/24 to any -> (le1)
|
|
#
|
|
# Rule 1 (NAT)
|
|
# Translate source address
|
|
# for outgoing connections
|
|
nat on le2 from 192.168.1.0/24 to any -> (le2)
|
|
|
|
# Policy compiler errors and warnings:
|
|
# firewall40-1:Policy:9: error: Only one router specified with load balancing for rule action Route: 'route_through'
|
|
# firewall40-1:Policy:10: error: Only one router specified with load balancing for rule action Route: 'route_through'
|
|
# firewall40-1:Policy:11: error: Illegal IP address for next hop
|
|
# firewall40-1:Policy:11: error: Only one router specified with load balancing for rule action Route: 'route_through'
|
|
#
|
|
# Rule 0 (fxp0)
|
|
pass in quick on fxp0 route-to { ( le1 192.0.2.1 ) , ( le1 192.0.2.2 ) , ( le1 192.0.2.3 ) } random inet proto tcp from 192.168.1.0/24 to any port 80 keep state label "RULE 0 -- ACCEPT "
|
|
#
|
|
# Rule 1 (fxp0)
|
|
pass in quick on fxp0 route-to { ( le2 192.0.2.1 ) , ( le2 192.0.2.2 ) , ( le2 192.0.2.3 ) } round-robin inet proto tcp from 192.168.1.0/24 to any port 80 keep state label "RULE 1 -- ACCEPT "
|
|
#
|
|
# Rule 2 (fxp0)
|
|
pass in quick on fxp0 route-to { ( le2 192.0.2.1 ) , ( le2 192.0.2.2 ) , ( le2 192.0.2.3 ) } round-robin inet proto tcp from 192.168.1.0/24 to any port 80 keep state label "RULE 2 -- ACCEPT "
|
|
#
|
|
# Rule 3 (fxp0)
|
|
pass in quick on fxp0 route-to { ( le1 192.0.2.1 ) , ( le1 192.0.2.2 ) , ( le1 192.0.2.3 ) } round-robin inet proto tcp from 192.168.1.0/24 to any port 80 label "RULE 3 -- ACCEPT "
|
|
#
|
|
# Rule 4 (fxp0)
|
|
pass in quick on fxp0 route-to { ( le2 192.0.2.1 ) , ( le2 192.0.2.2 ) , ( le2 192.0.2.3 ) } round-robin inet proto tcp from 192.168.1.0/24 to any port 80 label "RULE 4 -- ACCEPT "
|
|
#
|
|
# Rule 5 (fxp0)
|
|
pass in quick on fxp0 route-to { ( le2 192.0.2.1 ) , ( le2 192.0.2.2 ) , ( le2 192.0.2.3 ) } round-robin inet proto tcp from 192.168.1.0/24 to any port 80 label "RULE 5 -- ACCEPT "
|
|
#
|
|
# Rule 6 (fxp0)
|
|
pass in quick on fxp0 route-to { ( le1 192.0.2.0/24 ) } random inet proto tcp from 192.168.1.0/24 to any port 80 keep state label "RULE 6 -- ACCEPT "
|
|
#
|
|
# Rule 7 (fxp0)
|
|
pass in quick on fxp0 route-to { ( le2 192.0.2.0/24 ) } source-hash inet proto tcp from 192.168.1.0/24 to any port 80 keep state label "RULE 7 -- ACCEPT "
|
|
#
|
|
# Rule 8 (fxp0)
|
|
pass in quick on fxp0 route-to { ( le2 192.0.2.0/255.255.255.0 ) } round-robin inet proto tcp from 192.168.1.0/24 to any port 80 keep state label "RULE 8 -- ACCEPT "
|
|
#
|
|
# Rule 9 (fxp0)
|
|
# this should fail because
|
|
# it has one address for the next
|
|
# hop and it is /32.
|
|
# Run compiler with
|
|
# command line argument -xt
|
|
# to convert errors to warnings
|
|
# and make it generate .conf
|
|
# file anyway
|
|
pass in quick on fxp0 route-to { ( le2 192.0.2.1 ) } round-robin inet proto tcp from 192.168.1.0/24 to any port 80 keep state label "RULE 9 -- ACCEPT "
|
|
#
|
|
# Rule 10 (fxp0)
|
|
# this should fail because
|
|
# it has one address for the next
|
|
# hop and it is /32.
|
|
pass in quick on fxp0 route-to { ( le2 192.0.2.1/32 ) } round-robin inet proto tcp from 192.168.1.0/24 to any port 80 keep state label "RULE 10 -- ACCEPT "
|
|
#
|
|
# Rule 11 (fxp0)
|
|
# this should fail because
|
|
# it ip address in next hop
|
|
# is illegal
|
|
pass in quick on fxp0 route-to { ( le2 192.0.300.1/32 ) } round-robin inet proto tcp from 192.168.1.0/24 to any port 80 keep state label "RULE 11 -- ACCEPT "
|
|
#
|
|
# Rule fallback rule
|
|
# fallback rule
|
|
block quick inet from any to any label "RULE 10000 -- DROP "
|
|
|
|
load anchor routes from "/etc/firewall40-1-routes.conf"
|