#Diagrama de la red
#
#ADSL --- bge0-FreeBSD-bge1---suiche---LAN
#
#bge0 192.168.7.100
#bge1 192.168.1.1
###############################################################################
# define macros for each network interface #
############################################
extif = "bge0"
intif = "bge1"
tcp_services = "{ 22, 443 }"
# define our networks
intnet = "{ 10.0.0.0/24, 192.168.1.0/24 }"
extaddr = "192.168.7.100"
natone = "192.168.7.100" #SSH, HTTP
mldonkey = "192.168.7.100"
# P2P client for BitTorrent, KaZaa, Donkey2000
#
bittorrent = "{ 6881, 6882, 6883, 6884, 6885, 6886, 6887, 6888, 6889 }"
fasttrack = "1214" #KaZaa
donkey2000_tcp = "{ 4662, 10696 }"
donkey2000_udp = "{ 4665, 4672 65535, 10700, 10838 }"
directconnect = "4444"
smb_ports = "{ 81,135,137,138,139,445 }"
# 81=requests, 135=wins, 137=name, 138=datagram, 139=session, 445=directory
streamers = "{ 192.168.1.120,192.168.1.121,192.168.1.122,192.168.1.123,\
192.168.1.128,192.168.1.130,192.168.1.131,192.168.1.250 }"
rtsp_ports_tcp = "{ 554 }" # rtsp 554 TCP
rtsp_ports_udp = "{ 5004,5005 }" # rtsp 5004 y 5005 UDP
mms_ports_tcp = "{ 1755 }" # mms 1755 TCP
mms_ports_udp = "{ 1755,1024:5000 }" # mms 1755, 1024-5000 UDP
http_ports = "{ 80,443,3128,2095,2082,8080,8083,4080,8090 }"
mail_ports = "{ 25,110,995,587 }"
ftp_ports = "{ 21,8021 }"
ssh_ports = "{ 22 }"
otters_ports = " { 53,67,143,5999,8102,8096,8091,8092,7777 }"
ftp_passive_ports = "{ 192.168.1.20,192.168.1.121,192.168.1.29 }"
icmp_types = "echoreq"
allproto = "{ tcp, udp, ipv6, icmp, esp, ipencap }"
privnets = "{ 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8, 127.0.0.0/8 \
0.0.0.0/8, 169.254.0.0/16, 192.0.2.0/24, 204.152.64.0/23 \
224.0.0.0/3, 240.0.0.0/4 }"
###############################################################################
# Tables: similar to macros, but more flexible for many addresses.#
###################################################################
#table <foo> { 10.0.0.0/8, !10.1.0.0/16, 192.168.0.0/24, 192.168.1.18 }
###############################################################################
# Options #
###########
set loginterface $extif
set block-policy drop
set optimization aggressive
###############################################################################
# Normalizes packets and masks the OS's shortcomings such as SYN/FIN packets #
##############################################################################
# [scrub reassemble tcp](BID 10183) and sequence number approximation
# bugs (BID 7487).
scrub on $extif reassemble tcp no-df random-id
###############################################################################
# Queueing: rule-based bandwidth control #
##########################################
###############################################################################
# NAT Rules #
#############
#no nat on $extif from $intnet to $www_server
#no nat on $extif proto tcp from $intif to $intnet
nat on $extif from $intif:network to any -> ($extif)
###############################################################################
# REDITECTIONS #
################
#HTTP, HTTPS, to natone
rdr on $extif proto tcp from any to any port 80 -> $natone
#rdr on $extif proto tcp from any to any port 443 -> $natone
#SSH to natone
rdr on $extif proto tcp from any to any port 22 -> $natone
# MLDonkey web interfaz
rdr on $extif proto tcp from any to any port 4080 -> $mldonkey
#Bittorrent
rdr on $extif proto tcp from any to any port $bittorrent -> $mldonkey
rdr on $extif proto udp from any to any port $bittorrent -> $mldonkey
# Fasttrack
rdr on $extif proto tcp from any to any port $fasttrack -> $mldonkey
rdr on $extif proto udp from any to any port $fasttrack -> $mldonkey
#Donkey2000
rdr on $extif proto tcp from any to any port $donkey2000_tcp -> $mldonkey
rdr on $extif proto udp from any to any port $donkey2000_udp -> $mldonkey
#DirectConnect
rdr on $extif proto tcp from any to any port $directconnect -> $mldonkey
rdr on $extif proto udp from any to any port $directconnect -> $mldonkey
# rdr outgoing WWW requests to the squid
rdr on $intif inet proto tcp from any to any port www -> 127.0.0.1 port 3128
# rdr outgoing ftp requests to the ftp-proxy
#rdr on $intif proto tcp from any to any port ftp -> 127.0.0.1 port 8021
block log
pass quick on lo0 all
#"Block drop in quick" will kill the rdr rules above for the privnet
block drop in on $extif from $privnets to any
block drop in on $extif from any to $privnets
###############################################################################
# Begin Selective Port Opening #
################################
#For a Mail server
#pass in on $extif proto tcp from any to any port 25 flags S/SA
#WebServer, HTTPS, 80
pass in on $extif proto tcp from any to any port 80 flags S/SA
#pass in on $extif proto tcp from any to any port $tcp_services flags S/SA synproxy state
pass in on $extif proto tcp from any to $natone port 80 flags S/SA keep state
# Block ssh bruteforce attempts http://johan.fredin.info/openbsd/block_ssh_bruteforce.html
# special rule for ssh
pass in on $extif proto tcp from any to ($extif) port ssh \
flags S/SA keep state \
(max-src-conn-rate 3/30, overload <ssh-bruteforce> flush global)
# block the ssh bruteforce bastards
block drop in quick on $extif from <ssh-bruteforce>
# allow ftp-proxy
#pass in on $extif inet proto tcp from port ftp-data to ($extif) \
user proxy flags S/SA keep state
# DNS server
pass in on $extif proto {tcp, udp} from any to any port 53
# MLDonkey web interfaz
pass in on $extif proto tcp from any to $mldonkey port 4080
# BitTorrent
pass in on $extif proto {tcp, udp} from any to $mldonkey port $bittorrent
# Fastrack
pass in on $extif proto {tcp, udp} from any to $mldonkey port $fasttrack
# Donkey2000
pass in on $extif proto tcp from any to $mldonkey port $donkey2000_tcp flags S/SA keep state
pass in on $extif proto udp from any to $mldonkey port $donkey2000_udp
# DirectConnect
pass in on $extif proto {tcp, udp} from any to $mldonkey port $directconnect
###############################################################################
# Basic Rules #
###############
pass in inet proto icmp all icmp-type $icmp_types keep state
# Lets keep the local net free
#pass in on $intif from $intif:network to any keep state
pass in quick on $intif proto {tcp,udp} from any to any port $http_ports keep state
pass in quick on $intif proto {tcp,udp} from any to any port $mail_ports keep state
pass in quick on $intif proto {tcp,udp} from any to any port $ftp_ports keep state
pass in quick on $intif proto {tcp,udp} from any to any port $ssh_ports keep state
pass in quick on $intif proto {tcp,udp} from any to any port $otters_ports keep state
# Allow fw to establish connections to internal net
#pass out on $intif from any to $intif:network keep state
pass out quick on $intif proto {tcp,udp} from any to any port $http_ports keep state
pass out quick on $intif proto {tcp,udp} from any to any port $mail_ports keep state
pass out quick on $intif proto {tcp,udp} from any to any port $ftp_ports keep state
pass out quick on $intif proto {tcp,udp} from any to any port $ssh_ports keep state
pass out quick on $intif proto {tcp,udp} from any to any port $otters_ports keep state
# Samba ports
pass in quick on $intif proto {tcp,udp} from any to any port $smb_ports keep state
pass out quick on $intif proto {tcp,udp} from any to any port $smb_ports keep state
# Passive ftp mode data channel high port numbers
pass in quick on $intif proto tcp from $ftp_passive_ports to any port >1024 keep state
pass out quick on $intif proto tcp from $ftp_passive_ports to any port >1024 keep state
# Permitimos streaming a $streamers a puertos $rtsp_ports $mms_ports
pass in quick on $intif inet proto tcp from any to $streamers port $rtsp_ports_tcp flags S/SA keep state
pass in quick on $intif inet proto udp from any to $streamers port $rtsp_ports_udp
pass in quick on $intif inet proto tcp from any to $streamers port $mms_ports_tcp flags S/SA keep state
pass in quick on $intif inet proto udp from any to $streamers port $mms_ports_udp
pass out quick on $intif inet proto tcp from any to $streamers port $rtsp_ports_tcp flags S/SA keep state
pass out quick on $intif inet proto udp from any to $streamers port $rtsp_ports_udp
pass out quick on $intif inet proto tcp from any to $streamers port $mms_ports_tcp flags S/SA keep state
pass out quick on $intif inet proto udp from any to $streamers port $mms_ports_udp
# Permitimos VPN
pass in quick on $intif proto tcp from any to any port 1723 keep state
pass out quick on $intif proto tcp from any to any port 1723 keep state
# Pass out TCP UDP, ICMP and ipv6
pass out on $extif proto ipv6 all
pass out on $extif proto tcp all modulate state flags S/SA
# Finalmente, dejar salir todo de la $extif
pass out on $extif all keep state