# cat /etc/pf.conf
# $FreeBSD: src/etc/pf.conf,v 1.2.2.1 2006/04/04 20:31:20 mlaier Exp $
# $OpenBSD: pf.conf,v 1.21 2003/09/02 20:38:44 david Exp $
#
# See pf.conf(5) and /usr/share/examples/pf for syntax and examples.
# Required order: options, normalization, queueing, translation, filtering.
# Macros and tables may be defined and used anywhere.
# Note that translation rules are first match while filter rules are last match.
# Rules must be in order: options, normalization, queueing, translation, filtering
# Options
set fingerprints "/etc/pf.os"
#### My Crap #####
# Macros
ext_if = "xl0"
int_if = "xl1"
int1_if = "xl2"
static_net = "10.0.1.0/25"
int_ifs = "{ xl1, xl2 }"
v6_ifs = "{ gif0, gif1, gif2, gif3, gif4, gif5, gif6, gif7, gif8, gif9, gif10 }"
brute_ports = "{ 22, 3290, 20, 21 }"
tcp_rdr_ports = "{ 20, 21, 22, 25, 53, 56, 80, 110, 8921, 9000, 9001, 8100, 143, 443 }"
udp_rdr_ports = "{ 20, 21, 53, 143, 1910, 8921 }"
table <bruteforce> persist
table <bruteforce6> persist
table <dhcp_net> { 10.0.1.128/25 }
# Block stuff first
# Normalization: reassemble fragments and resolve or reduce traffic ambiguities.
scrub in all
# NAT The internal nets
nat on $ext_if from $static_net to any -> ($ext_if)
# Redirects
rdr on $ext_if proto tcp from any to $ext_if port $tcp_rdr_ports -> 10.0.1.2
rdr on $ext_if proto udp from any to $ext_if port $udp_rdr_ports -> 10.0.1.2
pass proto tcp from any to 10.0.1.2 port $tcp_rdr_ports flags S/SA keep state
# Block between
#block drop in quick on $ext_if from $martians to any
#block drop out quick on $ext_if from any to $martians
block drop in on $int_ifs from <dhcp_net> to any
block drop out on $int_ifs from any to <dhcp_net>
# Block Spoofs
antispoof for $ext_if
# SSH Flooding (For both router and server(s)
block quick from <bruteforce> to any
pass log quick proto { tcp, udp } from any to xl0 port $brute_ports flags S/SA keep state (max-src-conn 5, max-src-conn-rate 3/7, overload <bruteforce> flush global)
pass log quick inet6 proto { tcp, udp } from any to any flags S/SA keep state (max-src-conn 5, max-src-conn-rate 5/15, overload <bruteforce6> flush global)
# Block Other
block in inet6 from any to 2001:4830:2018:f0::/60
block in quick inet from 210.0.0.0/7 to any
block in quick inet from 222.0.0.0/8 to any
# IPv6 Stuff
pass in quick inet6 from 2001:4830:2018::/48 to 2001:4830:2018:f0::/60