mirror of
https://github.com/fwbuilder/fwbuilder
synced 2026-05-01 14:47:27 +02:00
344a22feed
compiler for PF does not need to generate protocol match "proto {tcp
udp icmp}" when service object used in the NAT rule is "any". The
reason this was done this way is lost in the mist of time; it's been
like this since very early versions of fwbuilder.
24 lines
629 B
Plaintext
24 lines
629 B
Plaintext
|
|
|
|
|
|
#
|
|
# Rule 0 (NAT)
|
|
# rule is attached to physical interface en0
|
|
# but uses address of carp0 for translation
|
|
nat on en0 from 192.168.1.0/24 to any -> (carp0)
|
|
|
|
#
|
|
# Rule -3 CARP (automatic)
|
|
pass quick on vlan100 inet proto carp from any to any label "RULE -4 -- ACCEPT "
|
|
#
|
|
# Rule -2 CARP (automatic)
|
|
pass quick on en1 inet proto carp from any to any label "RULE -3 -- ACCEPT "
|
|
#
|
|
# Rule -1 CARP (automatic)
|
|
pass quick on en0 inet proto carp from any to any label "RULE -2 -- ACCEPT "
|
|
#
|
|
# Rule fallback rule
|
|
# fallback rule
|
|
block quick inet from any to any no state label "RULE -1 -- DROP "
|
|
|