# Firewall on FreeBSD with PF: The OpenBSD Packet Filter
#
# How-tos:
# FreeBSD http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/
# PF: The OpenBSD Packet Filter http://www.openbsd.org/faq/pf/index.html
#
# Conexion Monopuesto:
# En este caso el router es simplemente utilizado como un Modem, ya que es el
# FreeBSD quien envia el usuario y la contrasena a nuestro ISP para solicitar
# conexion (esto genera la interface tun0 y se configura PPPoE en FreeBSD).
# En este caso ext_if = "tun0"
#
# The network is setup like this:
#
# ISP---ADSL---(ext_if)-[FreeBSD]-(int_if)---Suiche---LAN
# \
# '-(dmz_if)
#
# Conexion Multipuesto:
# En este caso es el router quien envia el nombre de usuario y la contrasena a
# nuestro ISP y los equipos conectados a este router lo utilizan como puerta
# de enlace (gateway) para obtener una salida a internet.
# En este caso ext_if = "bge0"
#
# The network is setup like this:
#
# ISP---ADSL---(ext_if)-[FreeBSD]-(int_if)---Suiche---LAN
# \
# '-(dmz_if)
#
# Fibra Optica
# En este caso al servidor le entra un pacth cord y la IP publica se le pone a
# la tarjeta de red del servidor.
#
# The network is setup like this:
#
# ISP----------(ext_if)-[FreeBSD]-(int_if)---Suiche---LAN
# \
# '-(dmz_if)
#
# Historial de cambios:
#
# * 13-01-2010 Historial de cambios
# * 16-04-2010 Se retoca la parte de P2P para agregar un puerto para kademlia
# * 06-05-2010 Se agregan los puertos TCP 3493 y 3551 de NUT y APC respectivamente
# * 28-05-2010 Se agrega el puerto TCP 3306 de MySQL para Control tiempo
# * 04-06-2010 Se agrega redireccion a la UPS APC SURT10000XLT-1TF10K
# * 21-09-2010 Se abren puertos para Transmission net-p2p y desactivamos MLDonkey
# * 03-02-2011 Cambios en comentarios
# * 23-02-2011 La conexion a internet queda en modo multipuesto ext_if = "bge0"
# Actualizar el contenido de:
# /etc/hosts para que tenga las IPs correctas
# /etc/hosts.allow
# /usr/local/etc/smb.conf
# * 25-02-2011 Se cambia el diagrama para mostrar ADSL y FIBRA
# * 06-03-2011 Se configura OpenVPN (tap0) y se abren puertos (1194UDP)
# * 12-05-2011 Se agrega redireccion a Ekiga y se abren puertos
#-------------------------------------------------------------------------------
# PF: List and Macros
#-------------------------------------------------------------------------------
logopt = "log"
# Interfaces
ext_if = "bge0" # Internet Interface (bge0 o tun0)
int_if = "bge1" # Network Interface LAN
#dmz_if = "bge2" # Network Interface DMZ
vpn_if = "tap0" # OpenVPN Interface
# External services
serv_tcp = "{ 5432, 667 }"
serv_udp = "{ 1194 }"
# Internal services
lanserv_tcp = "{ 21, 22, 37, 53, 80, 443, 110, 995, 993, 25, 465, 518, 587, \
1626, 1723, 2082, 2095, 8080, 8083, 4080, 8090, 8091, 8092, 7777, \
5432, 5999, 9339, 1935, 8021, 3128, 6667, 8030, 8443, 993, 587, \
3306, 7780, 7778, 81, 8001, 8099, 5900, 2628, 7781, 3493, 3551, \
8443, 1025, 8060, 2083, 9091, 6969, 667, 8082, 11371 }"
lanserv_udp = "{ 53, 67, 68, 69, 123, 1194 }"
# Ekiga http://wiki.ekiga.org/index.php/Enable_port_forwarding_manually
# http://wiki.ekiga.org/index.php/Internet_ports_used_by_Ekiga
ekiga_host = "{ 192.168.1.244 }"
ekiga_tcp = "{ 1720, 30000:30010 }"
ekiga_udp = "{ 3478, 3479, 5000:5100 }"
# Samba service
# If you are setting up a firewall, you need to know what TCP and UDP ports to
# allow and block. Samba uses the following:
# Port 135/TCP - used by smbd loc-srv
# Port 137/UDP - used by nmbd netbios-ns
# Port 138/UDP - used by nmbd netbios-dgm
# Port 139/TCP - used by smbd netbios-ssn
# Port 445/TCP - used by smbd microsoft-ds # no se requiere y da error en logs
# Port 901/TCP - used by swat
smb_tcp = "{ loc-srv, netbios-ssn, swat }"
smb_udp = "{ netbios-ns, netbios-dgm }"
# Las direcciones IPs de algunos dominios HTTPS bloqueados
# para saber la ip del dominio... $ host imo.im
# IP del dominio: imo.im
HTTPS_sites = "{ 64.13.161.61 }"
# P2P
#
# Transmission Port: /usr/ports/net-p2p/transmission-daemon
# Transmission (tcp 51413 defaul or range 49152:65535) i have open this range for ftp service >49151
# (firewall and p2p in same computer)
rpc_port_tcp = "9091" # Control web http://ipserver:9091
#peer_port_tcp = "51413" # Para el servicio de ftp esta abierto >49151
#peer_port_range_tcp = "{ 49152:65535 }" # Para el servicio de ftp esta abierto >49151
#
# MLDonkey Port: /usr/ports/net-p2p/mldonkey-core (port roto! Estoy usando Transmission)
# (firewall and p2p in same computer)
#
#donkey_ctl_tcp = "4080" # Control web http://ipserver:4080
# # .mldonkey/downloads.ini
# # section Interfaces
# # allowed_ips = ["127.0.0.1";
# # "0.0.0.0/0";] <- Adicionar
# #
# Ports for BitTorrent and Donkey # .mldonkey/donkey.ini
#bittorrent_tcp = "{ 6880:6889 }" #
#donkey_tcp = "11632" # section Donkey (TCP) port = 11632 <- Verificar
#donkey_udp = "11636" # (UDP) port = (donkey tcp port + 4) => 11636 <- Auto
# #
# Port for Kademlia (udp only) # .mldonkey/donkey.ini
#kademlia_udp = "15759" # section Kademlia port => 15759 <- Verificar
# #
#overnet = "7453" # .mldonkey/donkey.ini
# # section Overnet (TCP+UDP) = 7453
#
# For view the ports used in web interface Help+ / Sysinfo
#
# Network Port Type
# BitTorrent 6882 client_port TCP
# BitTorrent 6881 tracker_port TCP
# Core 4080 http_port TCP
# Core 4000 telnet_port TCP
# Core 4001 gui_port TCP
# Donkey 11632 client_port TCP
# Donkey 11636 client_port UDP
# Donkey 7453 overnet_port TCP+UDP
# Donkey 15759 kademlia_port UDP
#
# Becoming more secure web interface
# telnet ipserver 4000
# MLdonkey command-line:
# > useradd admin MYPASSWORD
# > q
#
# ON THE WEB INTERFACE SET
#
# Speed parameters: Upload Download
# Options max_hard_upload_rate 30 max_hard_download_rate 500
#
# Adding another p2p network (kademlia)
# Options / Net enable_kademlia true
# Externally permitted inbound icmp types
icmp_types= "echoreq"
# STREAMING
#
# IPs de los streamers (requerido para protocolo mms)
# Carlos D Jaime S Gerente Charlie Delta Web DELL W HP 2510p
#streamers = "{ 192.168.1.223, 192.168.1.224, 192.168.1.225, 192.168.1.250, 192.168.1.244, 192.168.1.221, 192.168.1.226, 192.168.1.216 }"
# Jorge Valencia BlackBerry
streamers = "{ 192.168.1.169 }"
#
# Using Windows Media Player with Firewalls
# http://www.microsoft.com/windows/windowsmedia/forpros/serve/firewall.aspx#Unicast
# Delivering a unicast stream
WMP_tcp = "{ 554, 1755 }"
WMP_udp = "{ 5004, 5005, 1755, 1024:5000 }"
#
# Using RealPlayer with Firewalls
# http://service.real.com/help/library/guides/helixuniversalproxy/htmfiles/firewall.htm
# Media Player Default Ports
ROP_tcp = "{ 554, 1090, 7878 }"
ROP_udp = "{ 554, 6970:32000 }"
# IPs de algunos que salen a ftp, es que tengo bloqueados los .exe y otros
# archivos peligrosos en el proxy WWW (squid) y por el proxy FTP (ftp-proxy) se pasan
# Carlos D Jaime S Bravo Charlie Delta Digiweb Juan Carlos Victor #2020 Yan Pruebas
usuarios_ftp = "{ 192.168.1.223, 192.168.1.224, 192.168.1.250, 192.168.1.250, 192.168.1.244, 192.168.1.221, 192.168.1.8, 192.168.1.63, 192.168.1.174, 192.168.1.119, 192.168.1.178, 192.168.1.194 }"
#-------------------------------------------------------------------------------
# PF: Tables
#-------------------------------------------------------------------------------
# RFC 1918 addresses that just shouldn't be floating around the Internet, and
# when they are, are usually trying to cause trouble
table <priv_nets> { 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8 }
#table <blockedips> persist file "/etc/pf.blocked.ip.conf"
# Manipulating with pfctl
# pfctl -t spammers -T show
# pfctl -t spammers -T add 218.70.0.0/16
# pfctl -t spammers -T delete 218.70.0.0/16
#-------------------------------------------------------------------------------
# PF: Options
#-------------------------------------------------------------------------------
set block-policy return
set loginterface $ext_if
set optimization aggressive
# Every Unix system has a "loopback" interface. It's a virtual network interface that
# is used by applications to talk to each other inside the system. On OpenBSD, the
# loopback interface is lo(4). It is considered best practice to disable all
# filtering on loopback interfaces. Using set skip will accomplish this.
set skip on lo
#-------------------------------------------------------------------------------
# PF: Scrub (Packet Normalization)
#-------------------------------------------------------------------------------
scrub all reassemble tcp no-df random-id
#-------------------------------------------------------------------------------
# PF: Packet Queueing and Priorization
#-------------------------------------------------------------------------------
# http://www.openbsd.org/faq/pf/queueing.html#example2
# http://www.openbsd.org/faq/pf/es/queueing.html#example2
#
# enable queueing on the external interface to queue packets going out
# to the Internet. use the cbq scheduler so that the bandwidth use of
# each queue can be controlled. the max outgoing bandwidth is 1.5Mbps.
#altq on $ext_if cbq bandwidth 1.5Mb queue { std_ext, www_ext, boss_ext }
# define the parameters for the child queues.
# std_ext - the standard queue. also the default queue for
# outgoing traffic on $ext_if.
# www_ext - container queue for WWW server queues. limit to
# 500Kbps.
# www_ext_http - http traffic from the WWW server; higher priority.
# www_ext_misc - all non-http traffic from the WWW server.
# boss_ext - traffic coming from the boss's computer.
#queue std_ext bandwidth 500Kb cbq(default borrow)
#queue www_ext bandwidth 500Kb { www_ext_http, www_ext_misc }
# queue www_ext_http bandwidth 50% priority 3 cbq(red borrow)
# queue www_ext_misc bandwidth 50% priority 1 cbq(borrow)
#queue boss_ext bandwidth 500Kb priority 3 cbq(borrow)
# enable queueing on the internal interface to control traffic coming
# from the Internet or the DMZ. use the cbq scheduler to control the
# bandwidth of each queue. bandwidth on this interface is set to the
# maximum. traffic coming from the DMZ will be able to use all of this
# bandwidth while traffic coming from the Internet will be limited to
# 1.0Mbps (because 0.5Mbps (500Kbps) is being allocated to $dmz_if).
#altq on $int_if cbq bandwidth 100% queue { net_int, www_int }
# define the parameters for the child queues.
# net_int - container queue for traffic from the Internet. bandwidth
# is 1.0Mbps.
# std_int - the standard queue. also the default queue for outgoing
# traffic on $int_if.
# it_int - traffic to the IT Dept network; reserve them 500Kbps.
# boss_int - traffic to the boss's PC; assign a higher priority.
# www_int - traffic from the WWW server in the DMZ; full speed.
#queue net_int bandwidth 1.0Mb { std_int, it_int, boss_int }
# queue std_int bandwidth 250Kb cbq(default borrow)
# queue it_int bandwidth 500Kb cbq(borrow)
# queue boss_int bandwidth 250Kb priority 3 cbq(borrow)
#queue www_int bandwidth 99Mb cbq(red borrow)
# enable queueing on the DMZ interface to control traffic destined for
# the WWW server. cbq will be used on this interface since detailed
# control of bandwidth is necessary. bandwidth on this interface is set
# to the maximum. traffic from the internal network will be able to use
# all of this bandwidth while traffic from the Internet will be limited
# to 500Kbps.
#altq on $dmz_if cbq bandwidth 100% queue { internal_dmz, net_dmz }
# define the parameters for the child queues.
# internal_dmz - traffic from the internal network.
# net_dmz - container queue for traffic from the Internet.
# net_dmz_http - http traffic; higher priority.
# net_dmz_misc - all non-http traffic. this is also the default queue.
#queue internal_dmz bandwidth 99Mb cbq(borrow)
#queue net_dmz bandwidth 500Kb { net_dmz_http, net_dmz_misc }
# queue net_dmz_http bandwidth 50% priority 3 cbq(red borrow)
# queue net_dmz_misc bandwidth 50% priority 1 cbq(default borrow)
#-------------------------------------------------------------------------------
# PF: Netkwork Address Translation (NAT) and Packet Redirection
#-------------------------------------------------------------------------------
# Translation rule exceptions
#no nat on $ext_if from 192.168.1.250 to any
# Network address translation
nat on $ext_if from !($ext_if) -> ($ext_if:0)
# En caso de requerir todo el canal para un solo equipo temporalmente debemos:
# Parar el squid
# Comentar la primera linea de nat y activar la segunda
# Poner la IP del equipo que tendra todo el canal
# Comentar la redireccion al proxy
# Recargar el firewall
#nat on $ext_if from 192.168.1.244 -> ($ext_if:0)
# OpenVPN
# NAT the VPN connections (for access to the remote secure networks)
nat on $vpn_if from !($ext_if) -> ($vpn_if:0)
# FTP-Proxy
nat-anchor "ftp-proxy/*"
rdr-anchor "ftp-proxy/*"
# Redirect ftp traffic to proxy (ftp-proxy)
rdr pass on $int_if proto tcp from any to port ftp \
-> 127.0.0.1 port 8021
# Redirect ftp traffic to proxy (ftp-proxy) only from $usuarios_ftp
#rdr pass on $int_if proto tcp from $usuarios_ftp to port ftp \
-> 127.0.0.1 port 8021
# Redirect ftp traffic to proxy (ftp-proxy) puerto fuera del estandar (CNTV)
rdr pass on $int_if proto tcp from any to port 18124 \
-> 127.0.0.1 port 8021
# Excepcion a la redireccion del WWW -> Squid para alguna IP
#no rdr on $int_if proto tcp from 192.168.1.244 to !$int_if port www
#no rdr on $int_if proto tcp from 192.168.1.96 to !$int_if port www
# Redirect and allow outgoing to WWW requests to the squid, but not from LAN to my server
rdr pass on $int_if proto tcp from any to !$int_if port www \
-> 127.0.0.1 port 3128
# Redirect and allow remote administration with SSH
# Echo (ssh user@alpha.telemedellin.tv -p 2222)
rdr pass on $ext_if proto tcp from any to port 2222 -> 192.168.1.180 \
port 22
# Pruebas (ssh user@alpha.telemedellin.tv -p 2223)
rdr pass on $ext_if proto tcp from any to port 2223 -> 192.168.1.178 \
port 22
# Redirect and allow remote administration with RealVNC
# Bravo
rdr pass on $ext_if proto tcp from any to port 5900 -> 192.168.1.251 \
port 5900
# Charlie
rdr pass on $ext_if proto tcp from any to port 5901 -> 192.168.1.250 \
port 5900
# Delta
rdr pass on $ext_if proto tcp from any to port 5903 -> 192.168.1.244 \
port 5900
# Echo
rdr pass on $ext_if proto tcp from any to port 5904 -> 192.168.1.180 \
port 5901
# Algun equipo temporalmente
#rdr pass on $ext_if proto tcp from any to port 5905 -> 192.168.1.96 \
port 5900
# Redirect and allow remote administration whit web browser
# UPS Alphasys (puerto 80)
rdr pass on $ext_if proto tcp from any to port 81 -> 192.168.1.252 port 80
# UPS MinuteMan (puerto 82)
rdr pass on $ext_if proto tcp from any to port 82 -> 192.168.1.251 port 82
# Control Encoder (puerto 80)
rdr pass on $ext_if proto tcp from any to port 83 -> 192.168.1.247 port 80
# Control Modulator (puerto 80)
rdr pass on $ext_if proto tcp from any to port 84 -> 192.168.1.248 port 80
# Control TANDBERG Encoder 8040
rdr pass on $ext_if proto tcp from any to port 85 -> 192.168.1.192 port 80
# Control TANDBERG 8092
rdr pass on $ext_if proto tcp from any to port 86 -> 192.168.1.193 port 80
# TANDERG RX8200
rdr pass on $ext_if proto tcp from any to port 87 -> 192.168.1.191 port 80
# UPS APC SURT10000XLT-1TF10K
rdr pass on $ext_if proto tcp from any to port 88 -> 192.168.1.187 port 80
# Dell PowerEdge R610 iDRAC6
rdr pass on $ext_if proto tcp from any to port 89 -> 192.168.1.179 port 80
# Dell PowerConnect 5424
#rdr pass on $ext_if proto tcp from any to port 90 -> 192.168.1.184 port 80
# Circuito Camaras
rdr pass on $ext_if proto tcp from any to port 91 -> 192.168.1.171 port 80
# TANDBERG Reciver
rdr pass on $ext_if proto tcp from any to port 92 -> 192.168.1.193 port 80
# Miranda Kaleido Model: X16-D S/N:086999-r45263010
rdr pass on $ext_if proto tcp from any to port 93 -> 192.168.1.170 port 80
# DarkStat
rdr pass on $ext_if proto tcp from any to port 668 -> 192.168.1.180 port 667
#
# Redirect and allow remote administration whit others
# Control HPA (puerto 2000)
rdr pass on $ext_if proto tcp from any to port 2000 -> 192.168.1.246 port 2000
# Camaras OLD (puerto 554:557)
#rdr pass on $ext_if proto tcp from any to port 554:557 -> 192.168.1.243 port 554:*
# examples
# Redirect range to one port... port 2000:2999 -> 4000
#rdr pass on $ext_if proto tcp from any to port 2000:2999 -> $host port 4000
# Redirect range to another range... port 2000 to 4000, 2001 to 4001,.. 2999 to 4999
#rdr pass on $ext_if proto tcp from any to port 2000:2999 -> $host port 4000:*
# Redirection
# Ekiga
rdr pass on $ext_if proto tcp from any to port $ekiga_tcp -> $ekiga_host
rdr pass on $ext_if proto udp from any to port $ekiga_udp -> $ekiga_host
# Redirection and Reflection
# Ekiga
#rdr pass on $ext_if proto tcp from any to ($ext_if) port $ekiga_tcp -> $ekiga_host
#rdr pass on $ext_if proto udp from any to ($ext_if) port $ekiga_udp -> $ekiga_host
#-------------------------------------------------------------------------------
# PF: Packet Filtering
#-------------------------------------------------------------------------------
# Restrictive default rules
block all
# Block packets and reply with a TCP RST or ICMP Unreachable response
#block return
# FTP-Proxy
# We need to have an anchor for ftp-proxy
anchor "ftp-proxy/*"
# Blocking Spoofed Packets (Paquetes Falsificados)
antispoof quick for {lo0 $int_if }
# Regla especial para poder hacer ping al ADSL que esta conectado en bge0
#pass out on bge0 keep state
# VPN connections inbound
pass in on $ext_if proto udp from any to port 1194 keep state
pass quick on $vpn_if
#-------------------------------------------------------------------------------
# Filter rules for $ext_if inbound
# Toy with script kiddies scanning us (nmap os detection block)
block in $logopt quick proto tcp flags FUP/WEUAPRSF
block in $logopt quick proto tcp flags WEUAPRSF/WEUAPRSF
block in $logopt quick proto tcp flags SRAFU/WEUAPRSF
block in $logopt quick proto tcp flags /WEUAPRSF
block in $logopt quick proto tcp flags SR/SR
block in $logopt quick proto tcp flags SF/SF
block drop in on $ext_if from { <priv_nets>, <blacklist> } to any
block drop in on $ext_if from $HTTPS_sites to any
# Bloquar alguna IP
#block in quick on $ext_if from <blockedips>
# Allow permitted icmp (ping)
#pass in on $ext_if inet proto icmp all icmp-type $icmp_types keep state
# PF "Self-Protecting" an FTP Server (pasv)
pass in on $ext_if proto tcp from any to any port { ftp, > 49151 } \
keep state
# Special rule for www (Block DDoS attempts to Apache)
table <abusive_hosts> persist
pass in on $ext_if proto tcp from any to port www \
flags S/SA keep state \
(max-src-conn 100, max-src-conn-rate 15/5, overload <abusive_hosts> flush global)
block in log quick on $ext_if proto tcp from <abusive_hosts> to any port www
# SSH Script
#
table <bruteforce> persist file "/root/list.txt"
block in log quick on $ext_if proto tcp from <bruteforce> to any port ssh
#pass in on $ext_if proto tcp from any to any port ssh keep state
# in crontab add this line:
# */2 * * * * /usr/home/hd1/backups/scripts/SSH-Script.sh >/dev/null 2>&1
#
# SSH Number Connections
#
table <bruteforce2> persist
pass in on $ext_if proto tcp from any to port ssh \
flags S/SA keep state \
(max-src-conn 100, max-src-conn-rate 2/5, overload <bruteforce2> flush global)
block in log quick on $ext_if proto tcp from <bruteforce2> to any port ssh
# Manipulating with pfctl
# pfctl -t bruteforce2 -T show
# pfctl -t bruteforce2 -T add 58.242.248.19
# pfctl -t bruteforce2 -T delete 58.242.248.19
# Block in by O.S
#block drop in log quick on $ext_if proto { tcp, udp } from any os Linux \
to port ssh label "Block ssh from Linux host"
# Special rule for ssh (Only allow some host)
#table <ssh_admin> persist file "/var/db/allowed-ips"
#pass in on $ext_if proto tcp from <ssh_admin> to port ssh \
flags S/SA keep state
# serv_tcp
pass in on $ext_if proto tcp from any to any port $serv_tcp \
flags S/SA keep state
# serv_udp
#pass in on $ext_if proto udp from any to any port $serv_udp
# P2P
#
# Transmission (tcp 51413 defaul or range 49152:65535) i have open this range for ftp service >49151
pass in on $ext_if proto tcp from any to ($ext_if) port $rpc_port_tcp \
flags S/SA keep state
#pass in on $ext_if proto tcp from any to ($ext_if) port $peer_port_tcp \
flags S/SA keep state
#pass in on $ext_if proto tcp from any to ($ext_if) port $peer_port_range_tcp \
flags S/SA keep state
#
# MLDonkey
#pass in on $ext_if proto tcp from any to ($ext_if) port $donkey_ctl_tcp \
# flags S/SA keep state
#pass in on $ext_if proto tcp from any to ($ext_if) port $bittorrent_tcp \
# flags S/SA keep state
#pass in on $ext_if proto tcp from any to ($ext_if) port $donkey_tcp \
# keep state
#pass in on $ext_if proto udp from any to ($ext_if) port $donkey_udp
# Port for Kademlia (udp only)
#pass in on $ext_if proto udp from any to ($ext_if) port $kademlia_udp
# Port for Overnet
#pass in on $ext_if proto {tcp, udp} from any to ($ext_if) port $overnet \
# flags S/SA keep state
#-------------------------------------------------------------------------------
# Filter rules for $ext_if outbound
pass out on $ext_if keep state
block drop out on $ext_if from any to { <priv_nets>, <blacklist> }
block drop out on $ext_if from any to $HTTPS_sites
#-------------------------------------------------------------------------------
# Filter rules for $int_if inbound
# Para pruebas, dejo pasar todo
#pass in on $int_if keep state
# Bloquear alguna IP (que por ejemplo este cargando el Squid)
#block in quick on $int_if from 192.168.1.11
# Bloqueo una IP de iLO que intenta actualizar el DNS constantemente
block in quick on $int_if from 192.168.1.172
# Temporalmente dejo salir a una IP a todos los puertos superiores a 1024
#pass in on $int_if proto tcp from 192.168.1.244 to any port >1024 \
keep state
# Allow permitted icmp (ping) Tracert usa ping!
pass in on $int_if inet proto icmp all icmp-type $icmp_types keep state
# Permitimos los puertos de Traceroute para tests
#pass in on $int_if proto udp from any to any port 33433:33626
# Network time protocol
pass in on $int_if proto udp from any to any port ntp
# STREMING
# Using Windows Media Player with Firewalls
pass in on $int_if proto tcp from $streamers to any port $WMP_tcp \
flags S/SA keep state
pass in on $int_if proto udp from $streamers to any port $WMP_udp
# Using RealOne Player with Firewalls
pass in on $int_if proto tcp from $streamers to any port $ROP_tcp \
flags S/SA keep state
pass in on $int_if proto udp from $streamers to any port $ROP_udp
# Icecast2 from lan
pass in on $int_if proto tcp from !($ext_if) to 192.168.1.1 port 8000 \
keep state
# NTOP from lan
#pass in on $int_if proto tcp from !($ext_if) to 192.168.1.1 port 3000 \
keep state
# lanserv_tcp
pass in on $int_if proto tcp from !($ext_if) to any port $lanserv_tcp \
keep state
# lanserv_udp
pass in on $int_if proto udp from !($ext_if) to any port $lanserv_udp
# Permitimos los puertos de SAMBA a la LAN
pass in on $int_if proto tcp from !($ext_if) to any port $smb_tcp \
keep state
pass in on $int_if proto udp from !($ext_if) to any port $smb_udp
# PF "Self-Protecting" an FTP Server
#pass in on $int_if proto tcp from !($ext_if) to $int_if port {ftp, \
> 49151 } keep state
# Ekiga
pass in on $int_if proto tcp from $ekiga_host to port $ekiga_tcp keep state
pass in on $int_if proto udp from $ekiga_host to any port $ekiga_udp
#-------------------------------------------------------------------------------
# Filter rules for $int_if outbound
pass out on $int_if keep state
#-------------------------------------------------------------------------------
# Filter rules for $dmz_if inbound
#-------------------------------------------------------------------------------
# Filter rules for $int_if_dmz outbound
#-------------------------------------------------------------------------------
# Filter rules for $vpn_if inbound
pass in on $vpn_if keep state
#-------------------------------------------------------------------------------
# Filter rules for $vpn_if outbound
pass out on $vpn_if keep state
# NOTAS:
#
# * El firewall en FreeBSD bloquea la entrada de todo por defecto.
# * FreeBSD puede salir a todo, excepto a algunas direcciones IPs listadas en:
# <priv_nets> y $HTTPS_sites.
# * Las peticiones de FTP las resuelve el proxy ftp-proxy.
# * Las peticiones de WWW las resuelve el proxy Squid-cache.
# * El control para la LAN se hace en la $lan_if1.
#
# Network UPS Tools requiere el puerto TCP 3493
# Nmap + PF http://forums.freebsd.org/showthread.php?t=3420
# Firewalls usually modify packets, hence nmap will not function properly.
# Nmap relies on odd/strange packets. Firewalls don't like that. Turn the firewall
# off when scanning.
# Nmap Changelog: http://nmap.org/changelog.html
# HOW-TOs:
#
# FTP-Proxy
# How-to: http://www.cyberciti.biz/faq/freebsd-opebsd-pf-firewall-ftp-configuration/
#
# Step # 1: Turn on ftp-proxy under FreeBSD
#
# Turn on ftp-proxy under FreeBSD
# Open /etc/rc.conf file under FreeBSD
# # vi /etc/rc.conf
# Append following line:
# ftpproxy_enable="YES"
#
# Step # 2: Configure pf and ftp-proxy
#
# Open your /etc/pf.conf file and add following into your NAT section:
# To activate it, put something like this in the NAT section of pf.conf:
# nat-anchor "ftp-proxy/*"
# rdr-anchor "ftp-proxy/*"
# rdr pass proto tcp from any to any port ftp -> 127.0.0.1 port 8021
#
# All three rules required, even if your setup does not use NAT. Find your filtering
# rule and append the following rules:
# anchor "ftp-proxy/*"
# Save and close the file.
#
# Step # 3: Restart PF firewall
#
# Type the following command under FreeBSD:
# # /etc/rc.d/pf restart
#
# Step # 4: Start ftp-proxy
#
# Type the following command to start ftp-proxy under, FreeBSD:
# # /etc/rc.d/ftp-proxy start
#
# For view the connections, type the following command under FreeBSD:
# # sockstat -4 |grep ftp-proxy
# proxy ftp-proxy 79457 3 tcp4 127.0.0.1:8021 *:*
#
# FTP SERVER PASV
# http://slacksite.com/other/ftp.html#passive