All pastes #2063815 Raw Edit

Stuff

public text v1 · immutable
#2063815 ·published 2011-05-18 18:07 UTC
rendered paste body
# Firewall on FreeBSD with PF: The OpenBSD Packet Filter
#
# How-tos: 
# FreeBSD	http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/
# PF: The OpenBSD Packet Filter	http://www.openbsd.org/faq/pf/index.html
#
# Conexion Monopuesto:
# En este caso el router es simplemente utilizado como un Modem, ya que es el
# FreeBSD quien envia el usuario y la contrasena a nuestro ISP para solicitar
# conexion (esto genera la interface tun0 y se configura PPPoE en FreeBSD).
# En este caso ext_if = "tun0"
#
# The network is setup like this:
#
# ISP---ADSL---(ext_if)-[FreeBSD]-(int_if)---Suiche---LAN
#                                \
#                                 '-(dmz_if)
#
# Conexion Multipuesto:
# En este caso es el router quien envia el nombre de usuario y la contrasena a
# nuestro ISP y los equipos conectados a este router lo utilizan como puerta
# de enlace (gateway) para obtener una salida a internet.
# En este caso ext_if = "bge0"
#
# The network is setup like this:
#
# ISP---ADSL---(ext_if)-[FreeBSD]-(int_if)---Suiche---LAN
#                                \
#                                 '-(dmz_if)
#
# Fibra Optica
# En este caso al servidor le entra un pacth cord y la IP publica se le pone a
# la tarjeta de red del servidor.
#
# The network is setup like this:
#
# ISP----------(ext_if)-[FreeBSD]-(int_if)---Suiche---LAN
#                                \
#                                 '-(dmz_if)
#
# Historial de cambios:
#
# * 13-01-2010	Historial de cambios           
# * 16-04-2010	Se retoca la parte de P2P para agregar un puerto para kademlia           
# * 06-05-2010	Se agregan los puertos TCP 3493 y 3551 de NUT y APC respectivamente
# * 28-05-2010	Se agrega el puerto TCP 3306 de MySQL para Control tiempo
# * 04-06-2010	Se agrega redireccion a la UPS APC SURT10000XLT-1TF10K
# * 21-09-2010	Se abren puertos para Transmission net-p2p y desactivamos MLDonkey
# * 03-02-2011	Cambios en comentarios
# * 23-02-2011	La conexion a internet queda en modo multipuesto ext_if = "bge0"
#		Actualizar el contenido de:
#		/etc/hosts para que tenga las IPs correctas
#		/etc/hosts.allow
#		/usr/local/etc/smb.conf
# * 25-02-2011	Se cambia el diagrama para mostrar ADSL y FIBRA
# * 06-03-2011	Se configura OpenVPN (tap0) y se abren puertos (1194UDP)
# * 12-05-2011	Se agrega redireccion a Ekiga y se abren puertos

#-------------------------------------------------------------------------------
# PF: List and Macros
#-------------------------------------------------------------------------------

logopt = "log"

# Interfaces
ext_if = "bge0"		# Internet Interface (bge0 o tun0)
int_if = "bge1"		# Network Interface  LAN
#dmz_if = "bge2"	# Network Interface  DMZ
vpn_if = "tap0"		# OpenVPN Interface

# External services
serv_tcp = "{ 5432, 667 }"
serv_udp = "{ 1194 }"

# Internal services
lanserv_tcp = "{ 21, 22, 37, 53, 80, 443, 110, 995, 993, 25, 465, 518, 587, \
	1626, 1723, 2082, 2095, 8080, 8083, 4080, 8090,  8091, 8092, 7777, \
	5432, 5999, 9339, 1935, 8021, 3128, 6667, 8030, 8443, 993, 587, \
	3306, 7780, 7778, 81, 8001, 8099, 5900, 2628, 7781, 3493, 3551, \
	8443, 1025, 8060, 2083, 9091, 6969, 667, 8082, 11371 }"
lanserv_udp = "{ 53, 67, 68, 69, 123, 1194 }"

# Ekiga http://wiki.ekiga.org/index.php/Enable_port_forwarding_manually
#       http://wiki.ekiga.org/index.php/Internet_ports_used_by_Ekiga
ekiga_host = "{ 192.168.1.244 }"
ekiga_tcp = "{ 1720, 30000:30010 }"
ekiga_udp = "{ 3478, 3479, 5000:5100 }"

# Samba service
# If you are setting up a firewall, you need to know what TCP and UDP ports to
# allow and block. Samba uses the following:
# Port 135/TCP - used by smbd loc-srv
# Port 137/UDP - used by nmbd netbios-ns
# Port 138/UDP - used by nmbd netbios-dgm
# Port 139/TCP - used by smbd netbios-ssn
# Port 445/TCP - used by smbd microsoft-ds # no se requiere y da error en logs
# Port 901/TCP - used by swat
smb_tcp = "{ loc-srv, netbios-ssn, swat }"
smb_udp = "{ netbios-ns, netbios-dgm }"

# Las direcciones IPs de algunos dominios HTTPS bloqueados
# para saber la ip del dominio... $ host imo.im
# IP del dominio:  imo.im
HTTPS_sites = "{ 64.13.161.61 }"

# P2P
#
# Transmission Port: /usr/ports/net-p2p/transmission-daemon
# Transmission (tcp 51413 defaul or range 49152:65535) i have open this range for ftp service >49151
# (firewall and p2p in same computer)
rpc_port_tcp = "9091"                    # Control web http://ipserver:9091
#peer_port_tcp = "51413"                 # Para el servicio de ftp esta abierto >49151
#peer_port_range_tcp = "{ 49152:65535 }" # Para el servicio de ftp esta abierto >49151
#
# MLDonkey Port: /usr/ports/net-p2p/mldonkey-core (port roto! Estoy usando Transmission)
# (firewall and p2p in same computer)
#
#donkey_ctl_tcp = "4080"                # Control web http://ipserver:4080
#                                       # .mldonkey/downloads.ini
#                                       # section Interfaces
#                                       # allowed_ips = ["127.0.0.1";
#                                       #                "0.0.0.0/0";] <- Adicionar
#                                       #
# Ports for BitTorrent and Donkey       # .mldonkey/donkey.ini
#bittorrent_tcp = "{ 6880:6889 }"	# 
#donkey_tcp = "11632"			# section Donkey (TCP) port = 11632 <- Verificar
#donkey_udp = "11636"			#                (UDP) port = (donkey tcp port + 4) => 11636 <- Auto
#					#
# Port for Kademlia (udp only)          # .mldonkey/donkey.ini
#kademlia_udp = "15759"			# section Kademlia port => 15759 <- Verificar
#                                       #
#overnet = "7453"			# .mldonkey/donkey.ini
#					# section Overnet (TCP+UDP) = 7453
#
# For view the ports used in web interface Help+ / Sysinfo
#
# Network	Port	Type
# BitTorrent    6882    client_port     TCP
# BitTorrent    6881    tracker_port    TCP
# Core          4080    http_port       TCP
# Core          4000    telnet_port     TCP
# Core          4001    gui_port        TCP
# Donkey        11632   client_port     TCP
# Donkey        11636   client_port     UDP
# Donkey        7453    overnet_port    TCP+UDP
# Donkey	15759	kademlia_port	UDP
#
# Becoming more secure web interface
# telnet ipserver 4000
# MLdonkey command-line:
# > useradd admin MYPASSWORD
# > q
#
# ON THE WEB INTERFACE SET
#
# Speed parameters:	Upload				Download
# Options		max_hard_upload_rate 30		max_hard_download_rate 500
# 
# Adding another p2p network (kademlia)
# Options / Net enable_kademlia true

# Externally permitted inbound icmp types
icmp_types= "echoreq"

# STREAMING
#
# IPs de los streamers (requerido para protocolo mms)
#               Carlos D       Jaime S        Gerente        Charlie        Delta          Web            DELL W         HP 2510p
#streamers = "{ 192.168.1.223, 192.168.1.224, 192.168.1.225, 192.168.1.250, 192.168.1.244, 192.168.1.221, 192.168.1.226, 192.168.1.216 }"
#		Jorge Valencia BlackBerry
streamers = "{ 192.168.1.169 }"
#
# Using Windows Media Player with Firewalls
# http://www.microsoft.com/windows/windowsmedia/forpros/serve/firewall.aspx#Unicast
# Delivering a unicast stream
WMP_tcp = "{ 554, 1755 }"
WMP_udp = "{ 5004, 5005, 1755, 1024:5000 }"
#
# Using RealPlayer with Firewalls
# http://service.real.com/help/library/guides/helixuniversalproxy/htmfiles/firewall.htm
# Media Player Default Ports
ROP_tcp = "{ 554, 1090, 7878 }"
ROP_udp = "{ 554, 6970:32000  }"

# IPs de algunos que salen a ftp, es que tengo bloqueados los .exe y otros 
# archivos peligrosos en el proxy WWW (squid) y por el proxy FTP (ftp-proxy) se pasan
#                 Carlos D       Jaime S        Bravo          Charlie        Delta          Digiweb        Juan Carlos  Victor        #2020          Yan            Pruebas
usuarios_ftp = "{ 192.168.1.223, 192.168.1.224, 192.168.1.250, 192.168.1.250, 192.168.1.244, 192.168.1.221, 192.168.1.8, 192.168.1.63, 192.168.1.174, 192.168.1.119, 192.168.1.178, 192.168.1.194 }"

#-------------------------------------------------------------------------------
# PF: Tables
#-------------------------------------------------------------------------------

# RFC 1918 addresses that just shouldn't be floating around the Internet, and 
# when they are, are usually trying to cause trouble 
table <priv_nets> { 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8 }

#table <blockedips> persist file "/etc/pf.blocked.ip.conf"

# Manipulating with pfctl
# pfctl -t spammers -T show
# pfctl -t spammers -T add 218.70.0.0/16
# pfctl -t spammers -T delete 218.70.0.0/16 

#-------------------------------------------------------------------------------
# PF: Options
#-------------------------------------------------------------------------------

set block-policy return
set loginterface $ext_if
set optimization aggressive

# Every Unix system has a "loopback" interface. It's a virtual network interface that
# is used by applications to talk to each other inside the system. On OpenBSD, the 
# loopback interface is lo(4). It is considered best practice to disable all 
# filtering on loopback interfaces. Using set skip will accomplish this.
set skip on lo

#-------------------------------------------------------------------------------
# PF: Scrub (Packet Normalization)
#-------------------------------------------------------------------------------

scrub all reassemble tcp no-df random-id

#-------------------------------------------------------------------------------
# PF: Packet Queueing and Priorization
#-------------------------------------------------------------------------------

# http://www.openbsd.org/faq/pf/queueing.html#example2
# http://www.openbsd.org/faq/pf/es/queueing.html#example2
#
# enable queueing on the external interface to queue packets going out
# to the Internet. use the cbq scheduler so that the bandwidth use of
# each queue can be controlled. the max outgoing bandwidth is 1.5Mbps.

#altq on $ext_if cbq bandwidth 1.5Mb queue { std_ext, www_ext, boss_ext }

# define the parameters for the child queues.
# std_ext        - the standard queue. also the default queue for
#                  outgoing traffic on $ext_if.
# www_ext        - container queue for WWW server queues. limit to
#                  500Kbps.
#   www_ext_http - http traffic from the WWW server; higher priority.
#   www_ext_misc - all non-http traffic from the WWW server.
# boss_ext       - traffic coming from the boss's computer.

#queue std_ext        bandwidth 500Kb cbq(default borrow)
#queue www_ext        bandwidth 500Kb { www_ext_http, www_ext_misc }
#  queue www_ext_http bandwidth 50% priority 3 cbq(red borrow)
#  queue www_ext_misc bandwidth 50% priority 1 cbq(borrow)
#queue boss_ext       bandwidth 500Kb priority 3 cbq(borrow)

# enable queueing on the internal interface to control traffic coming
# from the Internet or the DMZ. use the cbq scheduler to control the
# bandwidth of each queue. bandwidth on this interface is set to the
# maximum. traffic coming from the DMZ will be able to use all of this
# bandwidth while traffic coming from the Internet will be limited to
# 1.0Mbps (because 0.5Mbps (500Kbps) is being allocated to $dmz_if).

#altq on $int_if cbq bandwidth 100% queue { net_int, www_int }

# define the parameters for the child queues.
# net_int    - container queue for traffic from the Internet. bandwidth
#              is 1.0Mbps.
#   std_int  - the standard queue. also the default queue for outgoing
#              traffic on $int_if.
#   it_int   - traffic to the IT Dept network; reserve them 500Kbps.
#   boss_int - traffic to the boss's PC; assign a higher priority.
# www_int    - traffic from the WWW server in the DMZ; full speed.

#queue net_int    bandwidth 1.0Mb { std_int, it_int, boss_int }
#  queue std_int  bandwidth 250Kb cbq(default borrow)
#  queue it_int   bandwidth 500Kb cbq(borrow)
#  queue boss_int bandwidth 250Kb priority 3 cbq(borrow)
#queue www_int    bandwidth 99Mb cbq(red borrow)

# enable queueing on the DMZ interface to control traffic destined for
# the WWW server. cbq will be used on this interface since detailed
# control of bandwidth is necessary. bandwidth on this interface is set
# to the maximum. traffic from the internal network will be able to use
# all of this bandwidth while traffic from the Internet will be limited
# to 500Kbps.

#altq on $dmz_if cbq bandwidth 100% queue { internal_dmz, net_dmz }

# define the parameters for the child queues.
# internal_dmz   - traffic from the internal network.
# net_dmz        - container queue for traffic from the Internet.
#   net_dmz_http - http traffic; higher priority.
#   net_dmz_misc - all non-http traffic. this is also the default queue.

#queue internal_dmz   bandwidth 99Mb cbq(borrow)
#queue net_dmz        bandwidth 500Kb { net_dmz_http, net_dmz_misc }
#  queue net_dmz_http bandwidth 50% priority 3 cbq(red borrow)
#  queue net_dmz_misc bandwidth 50% priority 1 cbq(default borrow)

#-------------------------------------------------------------------------------
# PF: Netkwork Address Translation (NAT) and Packet Redirection
#-------------------------------------------------------------------------------

# Translation rule exceptions
#no nat on $ext_if from 192.168.1.250 to any

# Network address translation
nat on $ext_if from !($ext_if) -> ($ext_if:0)

# En caso de requerir todo el canal para un solo equipo temporalmente debemos:
# Parar el squid
# Comentar la primera linea de nat y activar la segunda
# Poner la IP del equipo que tendra todo el canal
# Comentar la redireccion al proxy
# Recargar el firewall
#nat on $ext_if from 192.168.1.244 -> ($ext_if:0)

# OpenVPN
# NAT the VPN connections (for access to the remote secure networks)
nat on $vpn_if from !($ext_if) -> ($vpn_if:0)

# FTP-Proxy
nat-anchor "ftp-proxy/*"
rdr-anchor "ftp-proxy/*"

# Redirect ftp traffic to proxy (ftp-proxy)
rdr pass on $int_if proto tcp from any to port ftp \
	-> 127.0.0.1 port 8021
# Redirect ftp traffic to proxy (ftp-proxy) only from $usuarios_ftp
#rdr pass on $int_if proto tcp from $usuarios_ftp to port ftp \
	-> 127.0.0.1 port 8021

# Redirect ftp traffic to proxy (ftp-proxy) puerto fuera del estandar (CNTV)
rdr pass on $int_if proto tcp from any to port 18124 \
        -> 127.0.0.1 port 8021

# Excepcion a la redireccion del WWW -> Squid para alguna IP
#no rdr on $int_if proto tcp from 192.168.1.244 to !$int_if port www
#no rdr on $int_if proto tcp from 192.168.1.96 to !$int_if port www
# Redirect and allow outgoing to WWW requests to the squid, but not from LAN to my server
rdr pass on $int_if proto tcp from any to !$int_if port www \
	-> 127.0.0.1 port 3128

# Redirect and allow remote administration with SSH
# Echo (ssh user@alpha.telemedellin.tv -p 2222)
rdr pass on $ext_if proto tcp from any to port 2222 -> 192.168.1.180 \
        port 22
# Pruebas (ssh user@alpha.telemedellin.tv -p 2223)
rdr pass on $ext_if proto tcp from any to port 2223 -> 192.168.1.178 \
        port 22

# Redirect and allow remote administration with RealVNC
# Bravo
rdr pass on $ext_if proto tcp from any to port 5900 -> 192.168.1.251 \
	port 5900
# Charlie
rdr pass on $ext_if proto tcp from any to port 5901 -> 192.168.1.250 \
	port 5900
# Delta
rdr pass on $ext_if proto tcp from any to port 5903 -> 192.168.1.244 \
	port 5900
# Echo
rdr pass on $ext_if proto tcp from any to port 5904 -> 192.168.1.180 \
	port 5901
# Algun equipo temporalmente
#rdr pass on $ext_if proto tcp from any to port 5905 -> 192.168.1.96 \
	port 5900

# Redirect and allow remote administration whit web browser
# UPS Alphasys (puerto 80)
rdr pass on $ext_if proto tcp from any to port 81 -> 192.168.1.252 port 80
# UPS MinuteMan (puerto 82)
rdr pass on $ext_if proto tcp from any to port 82 -> 192.168.1.251 port 82
# Control Encoder (puerto 80)
rdr pass on $ext_if proto tcp from any to port 83 -> 192.168.1.247 port 80
# Control Modulator (puerto 80)
rdr pass on $ext_if proto tcp from any to port 84 -> 192.168.1.248 port 80
# Control TANDBERG Encoder 8040
rdr pass on $ext_if proto tcp from any to port 85 -> 192.168.1.192 port 80
# Control TANDBERG 8092
rdr pass on $ext_if proto tcp from any to port 86 -> 192.168.1.193 port 80
#  TANDERG RX8200
rdr pass on $ext_if proto tcp from any to port 87 -> 192.168.1.191 port 80
# UPS APC SURT10000XLT-1TF10K
rdr pass on $ext_if proto tcp from any to port 88 -> 192.168.1.187 port 80
# Dell PowerEdge R610 iDRAC6
rdr pass on $ext_if proto tcp from any to port 89 -> 192.168.1.179 port 80
# Dell PowerConnect 5424
#rdr pass on $ext_if proto tcp from any to port 90 -> 192.168.1.184 port 80
# Circuito Camaras
rdr pass on $ext_if proto tcp from any to port 91 -> 192.168.1.171 port 80
# TANDBERG Reciver
rdr pass on $ext_if proto tcp from any to port 92 -> 192.168.1.193 port 80
# Miranda Kaleido Model: X16-D S/N:086999-r45263010
rdr pass on $ext_if proto tcp from any to port 93 -> 192.168.1.170 port 80
# DarkStat
rdr pass on $ext_if proto tcp from any to port 668 -> 192.168.1.180 port 667
#
# Redirect and allow remote administration whit others
# Control HPA (puerto 2000)
rdr pass on $ext_if proto tcp from any to port 2000 -> 192.168.1.246 port 2000
# Camaras OLD (puerto 554:557)
#rdr pass on $ext_if proto tcp from any to port 554:557 -> 192.168.1.243 port 554:*

# examples
# Redirect range to one port... port 2000:2999 -> 4000
#rdr pass on $ext_if proto tcp from any to port 2000:2999 -> $host port 4000
# Redirect range to another range... port 2000 to 4000, 2001 to 4001,.. 2999 to 4999
#rdr pass on $ext_if proto tcp from any to port 2000:2999 -> $host port 4000:*

# Redirection
# Ekiga
rdr pass on $ext_if proto tcp from any to port $ekiga_tcp -> $ekiga_host
rdr pass on $ext_if proto udp from any to port $ekiga_udp -> $ekiga_host

# Redirection and Reflection
# Ekiga
#rdr pass on $ext_if proto tcp from any to ($ext_if) port $ekiga_tcp -> $ekiga_host
#rdr pass on $ext_if proto udp from any to ($ext_if) port $ekiga_udp -> $ekiga_host

#-------------------------------------------------------------------------------
# PF: Packet Filtering
#-------------------------------------------------------------------------------

# Restrictive default rules
block all

# Block packets and reply with a TCP RST or ICMP Unreachable response
#block return

# FTP-Proxy
# We need to have an anchor for ftp-proxy
anchor "ftp-proxy/*"

# Blocking Spoofed Packets (Paquetes Falsificados)
antispoof quick for {lo0 $int_if }

# Regla especial para poder hacer ping al ADSL que esta conectado en bge0
#pass out on bge0 keep state

# VPN connections inbound
pass in on $ext_if proto udp from any to port 1194 keep state
pass quick on $vpn_if

#-------------------------------------------------------------------------------
# Filter rules for $ext_if inbound

# Toy with script kiddies scanning us (nmap os detection block)
block in $logopt quick proto tcp flags FUP/WEUAPRSF
block in $logopt quick proto tcp flags WEUAPRSF/WEUAPRSF
block in $logopt quick proto tcp flags SRAFU/WEUAPRSF
block in $logopt quick proto tcp flags /WEUAPRSF
block in $logopt quick proto tcp flags SR/SR 
block in $logopt quick proto tcp flags SF/SF

block drop in on $ext_if from { <priv_nets>, <blacklist> } to any

block drop in on $ext_if from $HTTPS_sites to any

# Bloquar alguna IP
#block in quick on $ext_if from <blockedips>

# Allow permitted icmp (ping)
#pass in on $ext_if inet proto icmp all icmp-type $icmp_types keep state

# PF "Self-Protecting" an FTP Server (pasv)
pass in on $ext_if proto tcp from any to any port { ftp, > 49151 } \
        keep state

# Special rule for www (Block DDoS attempts to Apache)
table <abusive_hosts> persist
pass in on $ext_if proto tcp from any to port www \
	flags S/SA keep state \
	(max-src-conn 100, max-src-conn-rate 15/5, overload <abusive_hosts> flush global)
block in log quick on $ext_if proto tcp from <abusive_hosts> to any port www

# SSH Script
#
table <bruteforce> persist file "/root/list.txt"
block in log quick on $ext_if proto tcp from <bruteforce> to any port ssh
#pass in on $ext_if proto tcp from any to any port ssh keep state
# in crontab add this line:
# */2 * * * * /usr/home/hd1/backups/scripts/SSH-Script.sh >/dev/null 2>&1
#
# SSH Number Connections
#
table <bruteforce2> persist
pass in on $ext_if proto tcp from any to port ssh \
        flags S/SA keep state \
        (max-src-conn 100, max-src-conn-rate 2/5, overload <bruteforce2> flush global)
block in log quick on $ext_if proto tcp from <bruteforce2> to any port ssh

# Manipulating with pfctl
# pfctl -t bruteforce2 -T show
# pfctl -t bruteforce2 -T add 58.242.248.19
# pfctl -t bruteforce2 -T delete 58.242.248.19

# Block in by O.S
#block drop in log quick on $ext_if proto { tcp, udp } from any os Linux \
	to port ssh label "Block ssh from Linux host"

# Special rule for ssh (Only allow some host)
#table <ssh_admin> persist file "/var/db/allowed-ips"
#pass in on $ext_if proto tcp from <ssh_admin> to port ssh \
	flags S/SA keep state

# serv_tcp
pass in on $ext_if proto tcp from any to any port $serv_tcp \
	flags S/SA keep state
# serv_udp
#pass in on $ext_if proto udp from any to any port $serv_udp

# P2P
#
# Transmission (tcp 51413 defaul or range 49152:65535) i have open this range for ftp service >49151
pass in on $ext_if proto tcp from any to ($ext_if) port $rpc_port_tcp \
       flags S/SA keep state
#pass in on $ext_if proto tcp from any to ($ext_if) port $peer_port_tcp \
       flags S/SA keep state
#pass in on $ext_if proto tcp from any to ($ext_if) port $peer_port_range_tcp \
       flags S/SA keep state
#
# MLDonkey 
#pass in on $ext_if proto tcp from any to ($ext_if) port $donkey_ctl_tcp \
#	flags S/SA keep state
#pass in on $ext_if proto tcp from any to ($ext_if) port $bittorrent_tcp \
#	flags S/SA keep state
#pass in on $ext_if proto tcp from any to ($ext_if) port $donkey_tcp \
#	keep state
#pass in on $ext_if proto udp from any to ($ext_if) port $donkey_udp
# Port for Kademlia (udp only)
#pass in on $ext_if proto udp from any to ($ext_if) port $kademlia_udp
# Port for Overnet
#pass in on $ext_if proto {tcp, udp} from any to ($ext_if) port $overnet \
#	flags S/SA keep state

#-------------------------------------------------------------------------------
# Filter rules for $ext_if outbound

pass out on $ext_if keep state

block drop out on $ext_if from any to { <priv_nets>, <blacklist> }

block drop out on $ext_if from any to $HTTPS_sites

#-------------------------------------------------------------------------------
# Filter rules for $int_if inbound

# Para pruebas, dejo pasar todo
#pass in on $int_if keep state

# Bloquear alguna IP (que por ejemplo este cargando el Squid)
#block in quick on $int_if from 192.168.1.11

# Bloqueo una IP de iLO que intenta actualizar el DNS constantemente
block in quick on $int_if from 192.168.1.172

# Temporalmente dejo salir a una IP a todos los puertos superiores a 1024
#pass in on $int_if proto tcp from 192.168.1.244 to any port >1024 \
        keep state

# Allow permitted icmp (ping) Tracert usa ping!
pass in on $int_if inet proto icmp all icmp-type $icmp_types keep state

# Permitimos los puertos de Traceroute para tests
#pass in on $int_if proto udp from any to any port 33433:33626

# Network time protocol
pass in on $int_if proto udp from any to any port ntp

# STREMING
# Using Windows Media Player with Firewalls
pass in on $int_if proto tcp from $streamers to any port $WMP_tcp \
        flags S/SA keep state
pass in on $int_if proto udp from $streamers to any port $WMP_udp
# Using RealOne Player with Firewalls
pass in on $int_if proto tcp from $streamers to any port $ROP_tcp \
        flags S/SA keep state
pass in on $int_if proto udp from $streamers to any port $ROP_udp

# Icecast2 from lan
pass in on $int_if proto tcp from !($ext_if) to 192.168.1.1 port 8000 \
	keep state

# NTOP from lan
#pass in on $int_if proto tcp from !($ext_if) to 192.168.1.1 port 3000 \
	keep state

# lanserv_tcp
pass in on $int_if proto tcp from !($ext_if) to any port $lanserv_tcp \
	keep state
# lanserv_udp
pass in on $int_if proto udp from !($ext_if) to any port $lanserv_udp

# Permitimos los puertos de SAMBA a la LAN
pass in on $int_if proto tcp from !($ext_if) to any port $smb_tcp \
	keep state
pass in on $int_if proto udp from !($ext_if) to any port $smb_udp

# PF "Self-Protecting" an FTP Server
#pass in on $int_if proto tcp from !($ext_if) to $int_if port {ftp, \
	> 49151 } keep state

# Ekiga
pass in on $int_if proto tcp from $ekiga_host to port $ekiga_tcp keep state
pass in on $int_if proto udp from $ekiga_host to any port $ekiga_udp

#-------------------------------------------------------------------------------
# Filter rules for $int_if outbound

pass out on $int_if keep state

#-------------------------------------------------------------------------------
# Filter rules for $dmz_if inbound

#-------------------------------------------------------------------------------
# Filter rules for $int_if_dmz outbound

#-------------------------------------------------------------------------------
# Filter rules for $vpn_if inbound
pass in on $vpn_if keep state

#-------------------------------------------------------------------------------
# Filter rules for $vpn_if outbound
pass out on $vpn_if keep state


# NOTAS:
#
# * El firewall en FreeBSD bloquea la entrada de todo por defecto.
# * FreeBSD puede salir a todo, excepto a algunas direcciones IPs listadas en:
#   <priv_nets> y $HTTPS_sites.
# * Las peticiones de FTP las resuelve el proxy ftp-proxy.
# * Las peticiones de WWW las resuelve el proxy Squid-cache.
# * El control para la LAN se hace en la $lan_if1.
#
# Network UPS Tools requiere el puerto TCP 3493

# Nmap + PF http://forums.freebsd.org/showthread.php?t=3420
# Firewalls usually modify packets, hence nmap will not function properly. 
# Nmap relies on odd/strange packets. Firewalls don't like that. Turn the firewall 
# off when scanning.
# Nmap Changelog: http://nmap.org/changelog.html

# HOW-TOs:
#
# FTP-Proxy
# How-to: http://www.cyberciti.biz/faq/freebsd-opebsd-pf-firewall-ftp-configuration/
#
# Step # 1: Turn on ftp-proxy under FreeBSD
#
# Turn on ftp-proxy under FreeBSD
# Open /etc/rc.conf file under FreeBSD
# # vi /etc/rc.conf
# Append following line:
# ftpproxy_enable="YES"
#
# Step # 2: Configure pf and ftp-proxy
#
# Open your /etc/pf.conf file and add following into your NAT section:
# To activate it, put something like this in the NAT section of pf.conf:
# nat-anchor "ftp-proxy/*"
# rdr-anchor "ftp-proxy/*"
# rdr pass proto tcp from any to any port ftp -> 127.0.0.1 port 8021
#
# All three rules required, even if your setup does not use NAT. Find your filtering
# rule and append the following rules:
# anchor "ftp-proxy/*"
# Save and close the file.
#
# Step # 3: Restart PF firewall
#
# Type the following command under FreeBSD:
# # /etc/rc.d/pf restart
#
# Step # 4: Start ftp-proxy
#
# Type the following command to start ftp-proxy under, FreeBSD:
# # /etc/rc.d/ftp-proxy start
#
# For view the connections, type the following command under FreeBSD:
# # sockstat -4 |grep ftp-proxy
# proxy    ftp-proxy  79457 3  tcp4   127.0.0.1:8021        *:*
#
# FTP SERVER PASV
# http://slacksite.com/other/ftp.html#passive