# http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/firewalls-ipf.html
#################################################################
# No restrictions on Inside LAN Interface for private network
# Not needed unless you have LAN
#################################################################
pass out quick on bge1 all
pass in quick on bge1 all
# Por emergencia activo salida y entrada a todo desde internet
# (Esto deja en peligro la LAN)
#pass out quick on bge0 all
#pass in quick on bge0 all
#################################################################
# No restrictions on Loopback Interface
#################################################################
pass in quick on lo0 all
pass out quick on lo0 all
#################################################################
# Interface facing Public Internet (Outbound Section)
# Interrogate session start requests originating from behind the
# firewall on the private network
# or from this gateway server destine for the public Internet.
#################################################################
# Allow out access to my ISP's Domain name server.
# xxx must be the IP address of your ISP's DNS.
# Dup these lines if your ISP has more than one DNS server
# Get the IP addresses from /etc/resolv.conf file
#pass out quick on bge0 proto tcp from any to xxx port = 53 flags S keep state
#pass out quick on bge0 proto udp from any to xxx port = 53 keep state
pass out quick on bge0 proto tcp from any to 0.0.0.0/0 port = 53 flags S keep state
pass out quick on bge0 proto udp from any to 0.0.0.0/0 port = 53 keep state
# Allow out access to my ISP's DHCP server for cable or DSL networks.
# This rule is not needed for 'user ppp' type connection to the
# public Internet, so you can delete this whole group.
# Use the following rule and check log for IP address.
# Then put IP address in commented out rule & delete first rule
pass out log quick on bge0 proto udp from any to any port = 67 keep state
#pass out quick on bge0 proto udp from any to z.z.z.z port = 67 keep state
# Allow out non-secure standard www function
pass out quick on bge0 proto tcp from any to any port = 80 flags S keep state
# Allow out secure www function https over TLS SSL
pass out quick on bge0 proto tcp from any to any port = 443 flags S keep state
# Allow out send & get email function
pass out quick on bge0 proto tcp from any to any port = 110 flags S keep state
pass out quick on bge0 proto tcp from any to any port = 25 flags S keep state
# Allow out send & get Gmail (pop 995, smtp 587)
pass out quick on bge0 proto tcp from any to any port = 995 flags S keep state
pass out quick on bge0 proto tcp from any to any port = 587 flags S keep state
# Allow out Time
pass out quick on bge0 proto tcp from any to any port = 37 flags S keep state
# Allow out nntp news
pass out quick on bge0 proto tcp from any to any port = 119 flags S keep state
# Allow out ntp
pass out quick on bge0 proto udp from any to any port = 123 keep state
# Allow out gateway & LAN users non-secure FTP ( both passive & active modes)
# This function uses the IPNAT built in FTP proxy function coded in
# the nat rules file to make this single rule function correctly.
# If you want to use the pkg_add command to install application packages
# on your gateway system you need this rule.
pass out quick on bge0 proto tcp from any to any port = 21 flags S keep state
# Allow out non-secure ftp (20 tcp + 1023-1500 tcp passive)
pass out quick on bge0 proto tcp from any port = 20 to any flags S keep state
pass out quick on bge0 proto tcp from any port 1023 >< 1500 flags S keep state
pass out quick on bge0 proto tcp from any port 49152 >< 65534 flags S keep state
# Allow out secure FTP, Telnet, and SCP
# This function is using SSH (secure shell)
pass out quick on bge0 proto tcp from any to any port = 22 flags S keep state
# Allow out non-secure Telnet
pass out quick on bge0 proto tcp from any to any port = 23 flags S keep state
# Allow out FBSD CVSUP function
pass out quick on bge0 proto tcp from any to any port = 5999 flags S keep state
# Allow out ping to public Internet
pass out quick on bge0 proto icmp from any to any icmp-type 8 keep state
# Allow out whois for LAN PC to public Internet
pass out quick on bge0 proto tcp from any to any port = 43 flags S keep state
# Allow out Cpanel
pass out quick on bge0 proto tcp from any to any port = 2082 flags S keep state
# Allow out Webmail Telemedellin
pass out quick on bge0 proto tcp from any to any port = 2095 flags S keep state
# Allow out Webmail Coldecon
pass out quick on bge0 proto tcp from any to any port = 8083 flags S keep state
# Allow out Correo Remoto EPM y Programa SCHIP Contaduria General
pass out quick on bge0 proto tcp from any to any port = 8080 flags S keep state
# Allow out Comision Nacional del Servicio Civil
pass out quick on bge0 proto tcp from any to any port = 8090 flags S keep state
#pass out quick on bge0 proto tcp from any to any port = 8100 flags S keep state
pass out quick on bge0 proto tcp from any to any port = 8102 flags S keep state
pass out quick on bge0 proto tcp from any to any port = 8096 flags S keep state
pass out quick on bge0 proto tcp from any to any port = 8091 flags S keep state
pass out quick on bge0 proto tcp from any to any port = 8092 flags S keep state
# Salida temporar algun puerto
#pass out quick on bge0 proto tcp from any to any port = 8300 flags S keep state
# Allow out Web Politecnico
pass out quick on bge0 proto tcp from any to any port = 7777 flags S keep state
# Allow out XChat
pass out quick on bge0 proto tcp from any to any port = 6667 flags S keep state
# Allow out Renso
pass out quick on bge0 proto tcp from any to any port = 10000 flags S keep state
# Allow out UPS Alphasys (81 -> 80)
pass out quick on bge0 proto tcp from any to any port = 81 flags S keep state
# Allow out 82 UPS MinuteMan (82 -> 81)
pass out quick on bge0 proto tcp from any to any port = 82 flags S keep state
# Allow out 83 Camaras
pass out quick on bge0 proto tcp from any to any port = 83 flags S keep state
# Allow out VNC
pass out quick on bge0 proto tcp from any to any port = 5900 flags S keep state
pass out quick on bge0 proto tcp from any to any port = 5901 flags S keep state
# Allow out PostgreSQL (5432)
pass out quick on bge0 proto tcp from any to any port = 5432 flags S keep state
# Allow out
pass out quick on bge0 proto tcp from any to any port = 48999 flags S keep state
# Allow out Windows Media Player
# RTSP out 554 TCP y 5004, 5005 UDP
pass out quick on bge0 proto tcp from any to any port = 554 flags S keep state
pass out quick on bge0 proto udp from any to any port = 5004 keep state
pass out quick on bge0 proto udp from any to any port = 5005 keep state
# MMS out 1755 TCP UDP y 1024-5000 UDP
pass out quick on bge0 proto tcp from any to any port = 1755 flags S keep state
pass out quick on bge0 proto udp from any to any port = 1755 keep state
# Allow out aMule
# (4661 TCP outgoing, 4662 TCP outgoing, 4712 TCP outgoing, 4665 UDP outgoing, 4672 UDP outgoing)
# http://www.emule-project.net/home/perl/help.cgi?l=1&rm=show_topic&topic_id=122
# http://www.emule-project.net/home/perl/help.cgi?l=1&rm=show_topic&topic_id=121
# http://tdn.no-ip.org/connection_test?port=4662
# ID edonkey -> IP http://lugdunum2k.free.fr/id.html#recup
pass out quick on bge0 proto tcp from any to any port = 4661 flags S keep state
pass out quick on bge0 proto tcp from any to any port = 4662 flags S keep state
pass out quick on bge0 proto tcp from any to any port = 4712 flags S keep state
pass out quick on bge0 proto udp from any to any port = 4665 keep state
pass out quick on bge0 proto udp from any to any port = 4672 keep state
# Allow out Azureus
# Incoming TCP listen port 6882 TCP/UDP, UDP listen port 6882
# Distributed DB dht.aelities.com 6883 TCP/UDP
# Tracker Server HTTP port 6969 UDP
pass out quick on bge0 proto tcp from any to any port = 6882 flags S keep state
pass out quick on bge0 proto udp from any to any port = 6882 keep state
pass out quick on bge0 proto tcp from any to any port = 6883 flags S keep state
pass out quick on bge0 proto udp from any to any port = 6883 keep state
# Allow out BitTorrent
pass out quick on bge0 proto tcp from any to any port = 6969 flags S keep state
# Block and log only the first occurrence of everything
# else that's trying to get out.
# This rule enforces the block all by default logic.
block out log first quick on bge0 all
#################################################################
# Interface facing Public Internet (Inbound Section)
# Interrogate packets originating from the public Internet
# destine for this gateway server or the private network.
#################################################################
# Block all inbound traffic from non-routable or reserved address spaces
block in quick on bge0 from 192.168.0.0/16 to any #RFC 1918 private IP
block in quick on bge0 from 172.16.0.0/12 to any #RFC 1918 private IP
block in quick on bge0 from 10.0.0.0/8 to any #RFC 1918 private IP
block in quick on bge0 from 127.0.0.0/8 to any #loopback
block in quick on bge0 from 0.0.0.0/8 to any #loopback
block in quick on bge0 from 169.254.0.0/16 to any #DHCP auto-config
block in quick on bge0 from 192.0.2.0/24 to any #reserved for docs
block in quick on bge0 from 204.152.64.0/23 to any #Sun cluster interconnect
block in quick on bge0 from 224.0.0.0/3 to any #Class D & E multicast
##### Block a bunch of different nasty things. ############
# That I do not want to see in the log
# Block frags
block in quick on bge0 all with frags
# Block short tcp packets
block in quick on bge0 proto tcp all with short
# block source routed packets
block in quick on bge0 all with opt lsrr
block in quick on bge0 all with opt ssrr
# Block nmap OS fingerprint attempts
# Log first occurrence of these so I can get their IP address
block in log first quick on bge0 proto tcp from any to any flags FUP
# Block anything with special options
block in quick on bge0 all with ipopts
# Block public pings
block in quick on bge0 proto icmp all icmp-type 8
# Block ident
block in quick on bge0 proto tcp from any to any port = 113
# Block all Netbios service. 137=name, 138=datagram, 139=session
# Netbios is MS/Windows sharing services.
# Block MS/Windows hosts2 name server requests 81
block in log first quick on bge0 proto tcp/udp from any to any port = 137
block in log first quick on bge0 proto tcp/udp from any to any port = 138
block in log first quick on bge0 proto tcp/udp from any to any port = 139
block in log first quick on bge0 proto tcp/udp from any to any port = 81
# Allow traffic in from ISP's DHCP server. This rule must contain
# the IP address of your ISP's DHCP server as it's the only
# authorized source to send this packet type. Only necessary for
# cable or DSL configurations. This rule is not needed for
# 'user ppp' type connection to the public Internet.
# This is the same IP address you captured and
# used in the outbound section.
pass in quick on bge0 proto udp from 0.0.0.0/0 to any port = 68 keep state
# Allow in standard www function because I have apache server
pass in quick on bge0 proto tcp from any to any port = 80 flags S keep state
# Allow in non-secure Telnet session from public Internet
# labeled non-secure because ID/PW passed over public Internet as clear text.
# Delete this sample group if you do not have telnet server enabled.
#pass in quick on bge0 proto tcp from any to any port = 23 flags S keep state
# Allow in non-secure FTP active/pasive
# http://asyd.net/home/docs/firewall/ipf/ftp
# SIP0 is the Public Interface, SIP1 is the DMZ One. 83.xxx.104.34 is the public FTP?s address
# Configuration sample (proftpd)
# PassivePorts 64000 65000
# IdentLookups off
#pass in quick on sip0 proto tcp from any to 83.xxx.104.34 port = 21 keep state # FTP Cmd
#pass in quick on sip0 proto tcp from any to 83.xxx.104.34 port 64000 >< 65000 flags S keep state # FTP Passive
#pass in quick on sip1 proto tcp from 83.xxx.104.34 port = 20 to any keep state # FTP Data (Active)
# Bloqueo los intentos de login de determinadas IPs
block in proto tcp from 86.121.179.158 to any port = 22
block in proto tcp from 81.211.12.218 to any port = 22
block in proto tcp from 190.12.75.112 to any port = 22
block in proto tcp from 85.126.79.107 to any port = 22
block in proto tcp from 59.74.112.9 to any port = 22
block in proto tcp from 201.46.240.26 to any port = 22
block in proto tcp from 59.144.40.25 to any port = 22
block in proto tcp from 218.188.21.102 to any port = 22
# Allow in secure FTP, Telnet, and SCP from public Internet
# This function is using SSH (secure shell)
pass in quick on bge0 proto tcp from any to any port = 22 flags S keep state
# Allow in VNC
#pass in quick on bge0 proto tcp from any to any port = 5900 flags S keep state
# Allow in UPS Alphasys (81 -> 80)
pass in quick on bge0 proto tcp from any to any port = 81 flags S keep state
# Allow in UPS MinuteMan (82 -> 82)
pass in quick on bge0 proto tcp from any to any port = 82 flags S keep state
# Allow in Camaras (83 -> 554:557)
pass in quick on bge0 proto tcp from any to any port = 83 flags S keep state
# Allow in Impresora Kyocera FS-1920 (84 -> 80)
#pass in quick on bge0 proto tcp from any to any port = 84 flags S keep state
# Allow in Impresora Kyocera FS-2000d (85 -> 80)
#pass in quick on bge0 proto tcp from any to any port = 85 flags S keep state
# Allow in Impresora Dell 5100cn (Contabilidad) (86 -> 80)
#pass in quick on bge0 proto tcp from any to any port = 86 flags S keep state
# Allow in Impresora Dell 5100cn2 (Graficacion) (87 -> 80)
#pass in quick on bge0 proto tcp from any to any port = 87 flags S keep state
# Allow in PostgreSQL (5432)
pass in quick on bge0 proto tcp from any to any port = 5432 flags S keep state
# Allow in aMule
# (4662 TCP incoming ,4711 TCP incoming, 4672 UDP incoming, 65535 UDP incoming)
# http://www.emule-project.net/home/perl/help.cgi?l=1&rm=show_topic&topic_id=122
# http://www.emule-project.net/home/perl/help.cgi?l=1&rm=show_topic&topic_id=121
# http://tdn.no-ip.org/connection_test?port=4662
# ID edonkey -> IP http://lugdunum2k.free.fr/id.html#recup
pass in quick on bge0 proto tcp from any to any port = 4662 flags S keep state
pass in quick on bge0 proto tcp from any to any port = 4711 flags S keep state
pass in quick on bge0 proto udp from any to any port = 4672 keep state
pass in quick on bge0 proto udp from any to any port = 65535 keep state
# Allow in Azureus
# Incoming TCP listen port 6882 TCP/UDP, UDP listen port 6882
# Distributed DB dht.aelities.com 6883 TCP/UDP
# Tracker Server HTTP port 6969 UDP
# HTML WebUI port 6886 UDP
pass in quick on bge0 proto tcp from any to any port = 6882 flags S keep state
pass in quick on bge0 proto udp from any to any port = 6882 keep state
pass in quick on bge0 proto tcp from any to any port = 6883 flags S keep state
pass in quick on bge0 proto udp from any to any port = 6883 keep state
pass in quick on bge0 proto udp from any to any port = 6969 keep state
# Allow in BitTorrent
pass in quick on bge0 proto tcp from any to any port = 6881 flags S keep state
# Block and log only first occurrence of all remaining traffic
# coming into the firewall. The logging of only the first
# occurrence stops a .denial of service. attack targeted
# at filling up your log file space.
# This rule enforces the block all by default logic.
block in log first quick on bge0 all
################### End of rules file #####################################