# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
#
# This configuration is set for use on a machine that is a router with
# three (3) network cards:
# ext_if - connects to the upstream link (cable/dsl modem, WAN, etc.)
# wifi_if - wireless card for internal network
# (if none present, remove all references to it in this file)
# lan_if - wired card for internal network
# (if none present, remove all references to it in this file)
#
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
#------------------------------------------------------------------------
# macros
#------------------------------------------------------------------------
logopt = "log"
# interfaces
ext_if = "bge0"
wifi_if = "ath0"
#lan_if = "fxp1"
# publically accesible services (transport layer neutral)
pubserv = "{ 80 }"
# internally accessible services (transport layer neutral)
lanserv = "{ 22, 53, 67, 80, 443, 8118 }"
# samba ports (transport layer neutral)
#samba_ports = "{ 137, 138, 139 }"
# externally permitted inbound icmp types
icmp_types = "echoreq"
# internal network
lan_net = "192.168.1.0/24"
# hosts granted acces to samba (cifs/smb) shares
smb_net = "{ 192.168.0.0/24, 71.222.203.202, 65.19.5.204, 81.22.244.181, 81.22.244.182 }"
# block these networks
table <badnetz> { 0.0.0.0/8, 10.0.0.0/8, 20.20.20.0/24, 127.0.0.0/8, \
169.254.0.0/16, 172.16.0.0/12, 192.0.2.0/24, 192.168.0.0/16, \
224.0.0.0/3, 255.255.255.255 }
#------------------------------------------------------------------------
# options
#------------------------------------------------------------------------
# config
set skip on ath0
set block-policy return
set loginterface $ext_if
set skip on lo0
# scrub
#scrub all reassemble tcp no-df
#scrub in all fragment reassemble
scrub out all random-id
scrub in on $ext_if all no-df min-ttl 100 max-mss 1440 fragment reassemble
scrub in on $ext_if all no-df min-ttl 100 max-mss 1440 fragment crop
#scrub in on $ext_if from $ext_ad to $prv_ad no-df min-ttl 100 max-mss 1440 fragment drop-ovl
#------------------------------------------------------------------------
# redirection (and nat, too!)
#------------------------------------------------------------------------
# network address translation
nat on $ext_if from $lan_net to any -> ($ext_if)
#------------------------------------------------------------------------
# firewall policy
#------------------------------------------------------------------------
# restrictive default rules
#block all
pass in quick on bge0 inet from 192.168.0.64 to any keep state label "RULE 0 -- ACCEPT "
#pass in quick on bge0 inet from 192.168.1.0/24 to any keep state label "RULE 0 -- ACCEPT "
block return-rst in $logopt on $ext_if proto tcp all
block return-icmp in $logopt on $ext_if proto udp all
block in $logopt on $ext_if proto icmp all
#block in quick from uprf-failed label uPRF
#block out $logopt on $ext_if all
# trust localhost
pass in quick on lo0 all
pass out quick on lo0 all
# anti spoofing
block drop in $logopt quick on $ext_if from <badnetz> to any
block drop out $logopt quick on $ext_if from any to <badnetz>
antispoof for { $wifi_if, $ext_if }
# anti fake return-scans
block return-rst out on $ext_if proto tcp all
block return-rst in on $ext_if proto tcp all
block return-icmp out on $ext_if proto udp all
block return-icmp in on $ext_if proto udp all
# toy with script kiddies scanning us
block in on $ext_if from any os unknown
block in $logopt quick proto tcp flags FUP/WEUAPRSF
block in $logopt quick proto tcp flags WEUAPRSF/WEUAPRSF
block in $logopt quick proto tcp flags SRAFU/WEUAPRSF
block in $logopt quick proto tcp flags /WEUAPRSF
block in $logopt quick proto tcp flags SR/SR
block in $logopt quick proto tcp flags SF/SF
# open firewall fully
# warning: insecure. 'nuff said.
pass in quick all
pass out quick all
# allow permitted icmp
pass in inet proto icmp all icmp-type $icmp_types keep state
# allow permitted services
pass in on $ext_if inet proto tcp from any to any port $pubserv flags S/SA synproxy state
pass in on {$wifi_if} inet proto {tcp udp} from $lan_net to any port $lanserv keep state
pass in on {$ext_if $wifi_if} inet proto {tcp udp} from $smb_net to any port $lanserv synproxy state
# permit access between LAN hosts
#pass in from $lan_net to $lan_net keep state
#pass out from $lan_net to $lan_net keep state
# permit full outbound access
# warning: potentially insecure. you may wish to lock down outbound access.
pass out from any to any keep state
Internet:
Destination Gateway Flags Refs Use Netif Expire
default home UGS 0 9321 bge0
localhost localhost UH 0 15243 lo0
192.168.0 link#1 UC 0 0 bge0
home 00:14:95:c1:fd:d1 UHLW 2 4229 bge0 1200
chi 00:13:20:c1:d6:64 UHLW 1 9 lo0
192.168.1 link#2 UC 0 0 ath0
192.168.1.64 00:13:02:22:4c:11 UHLW 1 5717 ath0 1191