mirror of
https://github.com/fwbuilder/fwbuilder
synced 2026-09-15 01:19:29 +02:00
Vadim Kurland
6a9fdbf3af
should use "(interface)" syntax to the right of "->" in NAT rules. This now works for all interfaces, including those that have ip addresses in fwbuilder configuration, when interface object appears in "Translated Source" in a nat rule. When firewall object appears in "Translated Source", it gets replaced with a set of its interfaces which also get translated into "-> (interface)".
56 lines
1.7 KiB
Plaintext
56 lines
1.7 KiB
Plaintext
|
|
set timeout udp.single 5
|
|
|
|
#
|
|
# Scrub rules
|
|
#
|
|
match all scrub (reassemble tcp no-df )
|
|
match out all scrub (random-id min-ttl 1 max-mss 1460)
|
|
|
|
# NAT compiler errors and warnings:
|
|
# firewall92:NAT:2: error: No translation rules are not supported for PF 4.7, use negation to implement exclusions
|
|
#
|
|
# Rule 0 (NAT)
|
|
match out on em0 proto {tcp udp icmp} from 10.1.1.0/24 to any nat-to (em0)
|
|
#
|
|
# Rule 1 (NAT)
|
|
match in on em0 proto udp from ! 10.3.14.41 to 10.3.14.81 port 161 rdr-to 10.1.1.1 port 161
|
|
#
|
|
# Rule 3 (NAT)
|
|
match in on em0 proto udp from any to 10.3.14.81 port 161 rdr-to 10.1.1.1 port 161
|
|
#
|
|
# Rule 4 (NAT)
|
|
match out on em1 proto {tcp udp icmp} from 10.1.1.0/24 to any nat-to (em0)
|
|
#
|
|
# Rule 5 (NAT)
|
|
match out on ! em0 proto {tcp udp icmp} from 10.1.1.0/24 to any nat-to 10.3.14.201
|
|
|
|
# Policy compiler errors and warnings:
|
|
# firewall92:Policy:0: warning: Changing rule direction due to self reference
|
|
#
|
|
# Rule backup ssh access rule
|
|
# backup ssh access rule
|
|
pass in quick inet proto tcp from 10.3.14.30 to self port 22 label "RULE -1 -- ACCEPT "
|
|
#
|
|
# Rule 0 (global)
|
|
# firewall92:Policy:0: warning: Changing rule direction due to self reference
|
|
|
|
pass in quick inet proto tcp from 10.3.14.0/24 to self port 22 label "RULE 0 -- ACCEPT "
|
|
#
|
|
# Rule 1 (global)
|
|
pass quick inet from 10.1.1.0/24 to any label "RULE 1 -- ACCEPT "
|
|
#
|
|
# Rule 2 (global)
|
|
match inet from any to 10.1.1.1 tag INTNET label "RULE 2 -- "
|
|
#
|
|
# Rule 3 (global)
|
|
pass quick inet proto udp from any to any port 161 label "RULE 3 -- ACCEPT "
|
|
#
|
|
# Rule 4 (global)
|
|
block log quick inet from any to any no state label "RULE 4 -- DROP "
|
|
#
|
|
# Rule fallback rule
|
|
# fallback rule
|
|
block quick inet from any to any no state label "RULE 10000 -- DROP "
|
|
|