################################################################ PF FIREWALL BY KiOrKY################################################################# macros - here's where you set variables for use in your rules####INTERFACES DECLARATIONloop="lo0"ext_if="rl0"int_if="rl1"ifs="rl"####HOSTS DEFINITION#ip_locales="{192.168.0.2,192.168.0.3,$birdy,192.168.0.7,$khalia}"addrtunnelipv6="213.121.24.85"alderia="192.168.0.xx"khalia="192.168.0.x"conshita="192.168.0.x"sakura="192.168.0.x"birdy="192.168.0.x"lutsianna="192.168.0.x"shapai="192.168.0.x"lut_win="192.168.0.x"adr_p2p=$birdyadr_bt=$birdylocal_net=$shapaitable <ip_locales> persist {$lut_win,$lutsianna,$alderia,$khalia,$conshita,$sakura,$birdy,$shapai}# rejetsports_blocked="{1227,2967,1025:1027,445,ms-sql-m,loc-srv,netbios-ssn,3306,5800,ms-sql-s,netbios-ns}"dams="62.160.32.43,www.dams.net,83.141.79.88"table <ever> persist {192.168.0.155,193.201.80.25,193.201.80.251,$dams}table <temp> persist {192.168.0.155}table <abusive_hosts> persist###################### POOLS d'IP# ircfreenode="bandit.probe-networks.de"freenode1="niven.freenode.osuosl.org"toto="kornbluth.freenode.net,zelazny.freenode.net"quakenet="bandit.probe-networks.de,82.211.16.16"quakenet2="82.211.16.17"ircnet="ircnet.nerim.fr"table <irc_auth> persist {$freenode1,$freenode,$ircnet,$quakenet,$quakenet2}# nntpnntp_servers1="news.free.fr"table <nntp_servers> persist {$nntp_servers1}##########################################################################################PLAGES DEFINITIONSunfiltered="{ lo0, rl1 }"# limitlimit_part=""#unfiltered="{ lo0}"#####ports macros# resteage_of_empires2_ports="'2299:2400 6073 7100:7200'"alderia_ssh_port="'https'"birdy_ssh_port="'667'"bt_ports="'12000:13999'"conshita_ftpd="'555'"conshita_ftpdpsv="'4051:4251'"conshita_ssh_port="'669'"dcc_ports="'4300:4400'"dns_ntp_q_ports="{domain ntp}"freeplayer_dest="'freeplayer.freebox.fr'"freeplayer_host=$lutsiannafreeplayer_port="'1234'"freeplayer_stream_port="'8080'"half_life_ports="'27005 27015:28500'"hq_ports="{22 443 666 667 668 669 670 671}"irc_ports="'6666:7000'"khalia_ftpd="'556'"khalia_ftpdpsv="'4252:4350'"khalia_ssh_port="'666'"lutsianna_ssh_port="'671'"p2p_ports="'10000:11999'"radio_ports="'8000:8001'"shapai_ssh_port="'670'"teamspeak_port="'8767'"tetrinet_port="'31457'"webhq_q_ports="{smtp 119}"worms_world_party_ports="'17010:17012 9999 5500:5510'"birdy_core_svcs="'ftp auth'"#####servicesalderia_svcs="{ ssh}"birdy_svcs="{" $birdy_core_svcs $teamspeak_port $dcc_ports $bt_ports $p2p_ports "}"conshita_svcs="{ smtp http }"khalia_svcs="{" $tetrinet_port $khalia_ssh_port $khalia_ftpdpsv $khalia_ftpd $radio_ports "}"lutsianna_svcs="{" $lutsianna_ssh_port $half_life_ports "}"shapai_lsvcs="{ ssh domain imap }"shapai_svcs="{ domain }"#####redirectionsssh_redirs="{666 667 668 669 670 443 671}"aprot="{tcp udp}"aprot6="{tcp udp icmp}"################################################################################################################################################################################## OPTIONS - network settingsset block-policy dropset loginterface $ext_if################################################################################################################################################################################ NORMALIZATION - Scrubbing will automatically drop TCP packets that have invalid# flag combinations, so there's no need for typical 'anti-portscan' rules that ipf# and ipfw use.scrub in on $ext_ifscrub out on $ext_if no-df random-id min-ttl 24 max-mss 1500################################################################################################################################################################################# ALTQ / QoS# altq on interface scheduler bandwidth bw qlimit qlim tbrsize size #queue { #queue_list }# #queue name [on interface] bandwidth bw [priority pri] [qlimit qlim] scheduler ( sched_options ) { #queue_list }# enable #queueing on the external interface to control traffic going to the Internet.#altq on $ext_if cbq bandwidth 1000Mb #queue {freeplayer,net}#queue freeplayer bandwidth 999Mb priority 1 cbq (red,ecn)#queue net bandwidth 736Kb priority 2 cbq { dl_out,web_out,webhq_out,h_p_out,hb_out} #queue hb_out bandwidth 406Kb priority 1 cbq ( borrow ) {p2p_out,httpd_out,radio_out} #queue p2p_out bandwidth 5% priority 1 cbq ( borrow ) #queue httpd_out bandwidth 75% priority 3 cbq ( borrow ) #queue radio_out bandwidth 20% priority 5 cbq ( borrow red ) #queue web_out bandwidth 170Kb priority 3 cbq ( default red ) #queue h_p_out bandwidth 150Kb priority 6 cbq ( borrow red ) { ipv6, h_p_out_m } #queue ipv6 bandwidth 30% priority 3 cbq #queue h_p_out_m bandwidth 70% priority 3 cbq ( borrow )################################################################################################################################################################################ TRANSLATIONS - nat, binat and rdr pass rules#nat [pass] on interface [af] from src_addr [port src_port] to \# dst_addr [port dst_port] -> ext_addr [pool_type] [static-port]#no nat on $unfiltered#no rdr pass on $unfiltered#ftp proxy#nat-anchor "ftp-proxy/*"#rdr pass-anchor "ftp-proxy/*"nat on $ext_if inet from <ip_locales> to any -> $ext_if# alderiardr pass on $ext_if inet proto $aprot from any to any port $alderia_svcs -> $alderia# birdyrdr pass on $ext_if inet proto $aprot from any to any port $birdy_svcs -> $birdy# conshitardr pass on $ext_if inet proto $aprot from any to any port $conshita_svcs -> $conshita# khaliardr pass on $ext_if inet proto $aprot from any to any port $khalia_svcs -> $khalia# lutsiannardr pass on $ext_if inet proto $aprot from any to any port $lutsianna_svcs -> $lutsianna# shapairdr pass on $ext_if inet proto $aprot from any to any port $shapai_svcs -> $shapai# sshrdr pass on $ext_if inet proto $aprot from any to any port $khalia_ssh_port -> $khalia port 22rdr pass on $ext_if inet proto $aprot from any to any port $birdy_ssh_port -> $birdy port 22rdr pass on $ext_if inet proto $aprot from any to any port $conshita_ssh_port -> $conshita port 22rdr pass on $ext_if inet proto $aprot from any to any port $alderia_ssh_port -> $alderia port 22rdr pass on $ext_if inet proto $aprot from any to any port $lutsianna_ssh_port -> $lutsianna port 22rdr pass on $ext_if inet proto $aprot from any to any port $shapai_ssh_port -> lo0 port 22# ipv6/ipv4rdr pass on $ext_if inet proto $aprot from $addrtunnelipv6 to any -> $alderia############################################################################################################################################################################### FILTER - specific rules for blocking and allowing various traffic#DNSpass quick proto $aprot to any port 53 keep statepass quick proto $aprot from any port 53 keep state######################### BLOQUER LES CHIEURS########################pass quick allblock quick proto $aprot from any port $ports_blockedblock quick proto $aprot to any port $ports_blockedblock quick from <ever>block quick to <ever>block quick log from <abusive_hosts>block quick log to <abusive_hosts>#####################################autoriser les ip forwardees# AUTORISATION POUR CES REDIRECTIONS##################################### Deny and log all by default This replaces 'block in all' and 'block out all'#dont log pfsync trames for logs sizeblock quick proto pfsyncblock logpass quick on $unfiltered keep state# default# autoriser les machines en sortie#pass quick proto $aprot to 192.168.0.11 keep statepass out proto $aprot from any to any flags S/SA keep state# haute qualite protcolspass out proto $aprot from any to any port $hq_ports keep state #queue h_p_out_mpass out proto $aprot from any port $hq_ports to any keep state #queue h_p_out_m#pass in on $ext_if inet proto tcp from port 20 to ($ext_if) user proxy flags S/SA keep state# auth/identdpass in proto $aprot from any to $birdy port auth keep state #queue irc_qpass out proto $aprot from any port auth to <irc_auth> keep state #queue irc_q# https, irc, mailpass out proto $aprot from any to any port $webhq_q_ports keep state# dns, ntppass out proto $aprot from any to any port $dns_ntp_q_ports keep state# sshpass out proto $aprot from any to any port ssh keep state #queue h_p_out_mpass out proto $aprot from any port ssh to any keep state #queue h_p_out_m# pingpass proto icmp from any to any keep state #queue h_p_out_m#### RDR PASS## P2P#pass in on $ext_if proto $aprot from any to $adr_p2p port $p2p_ports keep state #queue p2p_out#pass out on $ext_if proto $aprot from any port $p2p_ports to any keep state #queue p2p_out## bittorent#pass in quick on $ext_if inet proto $aprot from any to $adr_bt port $bt_ports keep state#pass out quick on $ext_if proto $aprot from any port $bt_ports to any keep state#pass out quick on $ext_if proto $aprot from any port 6881 to any keep state# ipv6/ipv4#pass in on $ext_if proto $aprot from $addrtunnelipv6 to $alderia keep state #queue httpd_out## service lutsianna#pass in on $ext_if proto $aprot from any to $lutsianna port lutsianna_svcs keep state #queue httpd_out## service alderia#pass in on $ext_if proto $aprot from any to $alderia port $alderia_svcs keep state #queue httpd_out## services birdy#pass in on $ext_if proto $aprot from any to $birdy port $birdy_svcs keep state #queue httpd_out## services khalia#pass in on $ext_if proto $aprot from any to $khalia port $khalia_svcs keep state #queue freeplayer## services conshita#pass in on $ext_if proto $aprot from any to $conshita port $conshita_svcs keep state #queue httpd_out## services shapai#pass proto $aprot from any to any port $shapai_svcs keep statepass proto $aprot from any port $shapai_svcs to anypass in on $ext_if proto $aprot from any to lo0 port ssh keep state #queue h_p_out_mpass proto $aprot from any to any port smtp #queue radio_outpass proto $aprot from any port smtp to any #queue radio_out######################################################################################################################################################################################### LOCAL########## mysql pour postfix#pass out on $int_if proto $aprot from any to $conshita port 3306# rsync pour les sauvegardes#pass in on $int_if proto $aprot from <ip_locales> to $shapai port 873 keep state#pass out on $int_if proto $aprot from $shapai to <ip_locales> port 873 keep state# services diverspass on $int_if proto $aprot from <ip_locales> to $shapai port $shapai_lsvcspass on $int_if proto $aprot from $shapai port $shapai_lsvcs to <ip_locales>#pass quick on $loop proto $aprot from ($loop) port {25,10024,10025} to ($loop) port {25,10024,10025}######################################################################################################################################################################################### IPv6###########tunnelbrocker="213.121.24.85"#tunnelbrocker="139.18.25.33"ifv6="stf0"irc_v6="2002:52e7:922b:13x37::1337,200xxxxxxx4a"birdy_v6="2002qsdfqsdfqsdf:fe05:1ab2"conshita_v6="200sdfgsdfgsdfg"lutsianna_v6="2002:52e7:922b:0:208:qsdfqsdfqsdfqdsfdcd"alderia_v6="2002:52e7:922b::qsdfqdsffffffffffff"khalia_ipv6="2002:52e7:922b:qdsfffffffffffffffffffff"shapai_v6="2002:52e7:922b::1qsdffffffffffffshapaiv6_lan="2002:52e7:922b:1337::0001"freenode_v6="2001:898:2000:3::1,2001:820:a3::2,sterling.freenode.net,2001:898:2000:3::1,2001:1418:13:1::25"ircnet_v6=""table <ipv6_irc_auth_dest> persist {$irc_v6,$khalia_ipv6}table <ipv6_irc_auth> persist {$freenode_v6}table <ipv6_locales> persist {$lutsianna_v6,$alderia_v6,$shapaiv6_lan,$irc_v6,$birdy_v6,$shapai_v6,$conshita_v6,$khalia_ipv6}######################################################################################################################################################################################### IPv6 Filter Rules########## bloquer par default#pass quick inet6 all keep stateblock inet6 all label ipv6#block log inet6 all label ipv6# pingpass quick inet6 proto icmp6 from any to any keep state #queue ipv6# laisser passer ipv6pass quick inet6 proto $aprot from <ipv6_locales> to any flags S/SA keep state #queue ipv6# boucle locale pour le tunnelpass quick on $loop inet6 proto $aprot from any to any #queue ipv6# auth ipv6pass in inet6 proto $aprot from <ipv6_irc_auth> to <ipv6_irc_auth_dest> port auth keep state#dnspass in inet6 proto $aprot to $shapaiv6_lan port domain keep state#httpdpass in inet6 proto $aprot from any to $conshita_v6 port http keep state# dcc et ircpass in inet6 proto $aprot from any to <ipv6_irc_auth_dest> port $dcc_ports keep state