$ cat pf.conf
ext_if="bge0"
int_if="bge1"
dmz_if="nfe0"
openvpn_if="tun0"
carp=" bge0 bge1 nfe0 "
pfsync="nfe1"
#table <spamd-white> persist
table <bruteforce> persist
set skip on lo
set block-policy return
#scrub in
nat on $ext_if from (carp1) -> (carp0:0)
rdr pass on $ext_if proto tcp from any to any port ssh \
-> 127.0.0.1 port ssh
rdr pass on $ext_if proto { tcp udp } from any to any port domain \
-> 127.0.0.1 port domain
rdr pass on $int_if proto { tcp udp } from any to any port domain \
-> 127.0.0.1 port domain
rdr pass on $ext_if proto tcp from any to any port time \
-> 127.0.0.1 port time
pass quick on $pfsync proto pfsync
pass quick on { $carp } proto carp
block in on $ext_if
pass in on $int_if
pass in on $dmz_if to ! $int_if:network
pass in proto icmp all label "in"
pass out keep state
$ cat ifconfig.carp
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 33168
groups: lo
inet 127.0.0.1 netmask 0xff000000
inet6 ::1 prefixlen 128
inet6 fe80::1%lo0 prefixlen 64 scopeid 0x6
nfe0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
lladdr 00:16:36:76:17:3b
description: dmz
media: Ethernet autoselect (1000baseT full-duplex,master)
status: active
inet 172.17.254.254 netmask 0xffffff00 broadcast 172.17.254.255
inet6 fe80::216:36ff:fe76:173b%nfe0 prefixlen 64 scopeid 0x1
nfe1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
lladdr 00:16:36:76:17:3c
description: pfsync
media: Ethernet autoselect (1000baseT full-duplex)
status: active
inet 172.17.128.254 netmask 0xffffff00 broadcast 172.17.128.255
inet6 fe80::216:36ff:fe76:173c%nfe1 prefixlen 64 scopeid 0x2
bge0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
lladdr 00:16:36:76:17:39
description: external gateway
media: Ethernet autoselect (1000baseT full-duplex,rxpause,txpause)
status: active
inet6 fe80::216:36ff:fe76:1739%bge0 prefixlen 64 scopeid 0x3
bge1: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
lladdr 00:16:36:76:17:3a
description: internal gateway
media: Ethernet autoselect (1000baseT full-duplex,rxpause,txpause)
status: active
inet 172.17.1.254 netmask 0xffffff00 broadcast 172.17.1.255
inet6 fe80::216:36ff:fe76:173a%bge1 prefixlen 64 scopeid 0x4
enc0: flags=0<> mtu 1536
pfsync0: flags=41<UP,RUNNING> mtu 1460
pfsync: syncdev: nfe1 syncpeer: 224.0.0.240 maxupd: 128
groups: carp pfsync
pflog0: flags=141<UP,RUNNING,PROMISC> mtu 33168
groups: pflog
carp0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
lladdr 00:00:5e:00:01:01
description: carp external gateway
carp: MASTER carpdev bge0 vhid 1 advbase 1 advskew 0
groups: carp egress
inet6 fe80::200:5eff:fe00:101%carp0 prefixlen 64 scopeid 0x8
inet 204.16.153.246 netmask 0xfffffffc broadcast 204.16.153.247
carp1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
lladdr 00:00:5e:00:01:01
description: carp internal gateway
carp: MASTER carpdev bge1 vhid 1 advbase 1 advskew 0
groups: carp
inet6 fe80::200:5eff:fe00:101%carp1 prefixlen 64 scopeid 0x9
inet 172.17.1.1 netmask 0xffffff00 broadcast 172.17.1.255
carp2: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
lladdr 00:00:5e:00:01:02
description: carp dmz
carp: MASTER carpdev nfe0 vhid 2 advbase 1 advskew 0
groups: carp
inet6 fe80::200:5eff:fe00:102%carp2 prefixlen 64 scopeid 0xa
inet 172.17.254.1 netmask 0xffffff00 broadcast 172.17.254.255
$ cat netstat.carp
Routing tables
Internet:
Destination Gateway Flags Refs Use Mtu Interface
default 204.16.153.245 UGS 0 0 - carp0
127/8 127.0.0.1 UGRS 0 0 33168 lo0
127.0.0.1 127.0.0.1 UH 0 0 33168 lo0
172.17.1/24 link#4 UC 0 0 - bge1
172.17.1.1 172.17.1.1 UH 0 0 - carp1
172.17.1.16 00:04:f2:15:04:4f UHLc 0 0 - bge1
172.17.128/24 link#2 UC 0 0 - nfe1
172.17.254/24 link#1 UC 0 0 - nfe0
172.17.254.1 172.17.254.1 UH 0 0 - carp2
204.16.153.244/30 link#8 UC 0 0 - carp0
204.16.153.245 00:01:97:36:b4:0a UHLc 0 0 - carp0
224/4 127.0.0.1 URS 0 0 33168 lo0
$ cat pfctl.carp
TRANSLATION RULES:
nat on bge0 from (carp1) to any -> (carp0:0)
rdr pass on bge0 inet proto tcp from any to any port = ssh -> 127.0.0.1 port 22
rdr pass on bge0 inet proto tcp from any to any port = domain -> 127.0.0.1 port 53
rdr pass on bge0 inet proto udp from any to any port = domain -> 127.0.0.1 port 53
rdr pass on bge1 inet proto tcp from any to any port = domain -> 127.0.0.1 port 53
rdr pass on bge1 inet proto udp from any to any port = domain -> 127.0.0.1 port 53
rdr pass on bge0 inet proto tcp from any to any port = time -> 127.0.0.1 port 37
FILTER RULES:
pass quick on bge0 proto carp all keep state
pass quick on bge1 proto carp all keep state
pass quick on nfe0 proto carp all keep state
pass quick on nfe1 proto pfsync all keep state
block return in on bge0 all
pass in on bge1 all flags S/SA keep state
pass in on nfe0 inet from any to ! 172.17.1.0/24 flags S/SA keep state
pass in proto icmp all keep state label "in"
pass out all flags S/SA keep state
pass quick on bge1 all no state label "local-nic" queue(def_in, pri_in)
pass quick on tun0 all no state label "local-nic" queue(def_in, pri_in)
pass quick on bge0 all no state label "local-nic" queue(def_in, pri_in)
pass quick on bge1 all no state label "local-nic" queue(def_in, pri_in)
pass quick on nfe0 all no state label "local-nic" queue(def_in, pri_in)
block drop in quick on ! lo inet from 127.0.0.0/8 to any
block drop in quick on ! lo inet6 from ::1 to any
block drop in quick inet from 127.0.0.1 to any
block drop in quick on ! bge1 inet from 172.17.1.0/24 to any
block drop in quick inet from 172.17.1.254 to any
block drop in quick inet6 from ::1 to any
block drop in quick on lo0 inet6 from fe80::1 to any
block drop in quick on bge1 inet6 from fe80::216:36ff:fe76:173a to any
pass in on bge0 proto tcp from any to (bge0) port = ssh flags S/SA keep state label "ssh-in" queue(def_in, pri_in)
pass in log on bge0 proto tcp from any to (bge0) port = smtp flags S/SA keep state
pass out log on bge0 proto tcp from (bge0) to any port = smtp flags S/SA keep state
pass in on bge0 proto tcp from any to any port = 1194 flags S/SA keep state label "openvpn" queue(def_in, pri_in)
pass in on bge0 proto udp from any to any port = 1194 keep state label "openvpn" queue(def_in, pri_in)
No queue in use
STATES:
all pfsync 172.17.128.254 -> 224.0.0.240 SINGLE:NO_TRAFFIC
all carp 204.16.153.246 -> 224.0.0.18 SINGLE:NO_TRAFFIC
all carp 172.17.1.254 -> 224.0.0.18 SINGLE:NO_TRAFFIC
all udp 127.0.0.1:53 <- 172.17.1.1:53 <- 172.17.1.148:35926 MULTIPLE:MULTIPLE
all udp 127.0.0.1:53 <- 172.17.1.1:53 <- 172.17.1.156:47836 MULTIPLE:MULTIPLE
all carp 172.17.254.254 -> 224.0.0.18 SINGLE:NO_TRAFFIC
all udp 127.0.0.1:53 <- 172.17.1.1:53 <- 172.17.1.213:32865 MULTIPLE:MULTIPLE
all udp 127.0.0.1:53 <- 172.17.1.1:53 <- 172.17.1.152:40327 MULTIPLE:MULTIPLE
all udp 127.0.0.1:53 <- 172.17.1.1:53 <- 172.17.1.160:57819 SINGLE:MULTIPLE
INFO:
Status: Enabled for 0 days 00:02:01 Debug: Urgent
State Table Total Rate
current entries 9
searches 68131 563.1/s
inserts 93 0.8/s
removals 84 0.7/s
Counters
match 67264 555.9/s
bad-offset 0 0.0/s
fragment 0 0.0/s
short 0 0.0/s
normalize 0 0.0/s
memory 0 0.0/s
bad-timestamp 0 0.0/s
congestion 0 0.0/s
ip-option 2 0.0/s
proto-cksum 0 0.0/s
state-mismatch 0 0.0/s
state-insert 0 0.0/s
state-limit 0 0.0/s
src-limit 0 0.0/s
synproxy 0 0.0/s
LABEL COUNTERS:
in 30582 0 0 0 0 0 0
local-nic 67171 3792 282105 3595 267145 197 14960
local-nic 63377 0 0 0 0 0 0
local-nic 63377 63376 3625228 26985 1479389 36391 2145839
local-nic 1 0 0 0 0 0 0
local-nic 1 1 72 0 0 1 72
ssh-in 0 0 0 0 0 0 0
openvpn 0 0 0 0 0 0 0
openvpn 0 0 0 0 0 0 0
TIMEOUTS:
tcp.first 120s
tcp.opening 30s
tcp.established 86400s
tcp.closing 900s
tcp.finwait 45s
tcp.closed 90s
tcp.tsdiff 30s
udp.first 60s
udp.single 30s
udp.multiple 60s
icmp.first 20s
icmp.error 10s
other.first 60s
other.single 30s
other.multiple 60s
frag 30s
interval 10s
adaptive.start 6000 states
adaptive.end 12000 states
src.track 0s
LIMITS:
states hard limit 10000
src-nodes hard limit 10000
frags hard limit 5000
tables hard limit 1000
table-entries hard limit 200000
TABLES:
bruteforce
OS FINGERPRINTS:
696 fingerprints loaded