# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
#
# This configuration is set for use on a machine that is a router with
# three (3) network cards:
# ext_if - connects to the upstream link (cable/dsl modem, WAN, etc.)
# wifi_if - wireless card for internal network
# (if none present, remove all references to it in this file)
# lan_if - wired card for internal network
# (if none present, remove all references to it in this file)
#
# Required order: options, normalization, queueing, translation, filtering.
# Macros and tables may be defined and used anywhere.
# Note that translation rules are first match while filter rules are last match.
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
#------------------------------------------------------------------------
# macros
#------------------------------------------------------------------------
logopt = "log"
# interfaces
ext_if = "bge0"
#wifi_if = "ath0"
lan_if = "bge1"
# publically accesible services (transport layer neutral)
pubserv = "{ 80, 443, ftp, ftp-data, 65500:65535 }"
#ftpserv = "{ ftp, ftp-data, 65500:65535 }"
# remote administration with RealVNC
vnc_tcp_port = "5900"
vnc_client = "192.168.1.76"
# internally accessible services (transport layer neutral)
lanserv = "{ 22, 53, 67, 80, 443, 25, 110, 995, 587, 21, 1626, 8021, 3128, 2082, 2095, 8080, 8083, 4080, \
8090, 143, 5999, 8102, 8096, 8091, 8092, 7777, 8000 }"
# samba ports (transport layer neutral)
samba_ports = "{ 42, 81, 135, 137, 138, 139, 445 }"
# externally permitted inbound icmp types
icmp_types = "echoreq"
# internal network
lan_net = "{ 192.168.0.0/24, 192.168.1.0/24 }"
# hosts granted acces to samba (cifs/smb) shares
smb_net = "{ 192.168.0.0/24, 192.168.1.0/24, 192.168.0.90, 192.168.1.90 }"
proxy_serv = "{ 21, 80, 443 }"
# MSN Messenger
msn_tcp_port = "{1863,6901,6891:6900}"
msn_udp_port = "{1503,3889,5004:65535}"
msn_messenger = "192.168.1.14"
# P2P
mldonkey = "192.168.7.100"
# P2P ports for BitTorrent and Donkey2000
bittorrent = "{ 6880, 6881:6889 }"
donkey2000_tcp = "{ 4662, 10696 }"
donkey2000_udp = "{ 4665, 4672 65535, 10700, 10838 }"
# IPs de los streamers
streamers = "{ 192.168.1.120,192.168.1.121,192.168.1.122,192.168.1.123,\
192.168.1.128,192.168.1.130,192.168.1.131,192.168.1.250 }"
# puertos para Windows Media Player
rtsp_ports_tcp = "{ 554,8554 }" # rtsp 554 TCP
rtsp_ports_udp = "{ 554,5004,5005,8554 }" # rtsp 5004 y 5005 UDP
mms_ports_tcp = "{ 1755 }" # mms 1755 TCP
mms_ports_udp = "{ 1755,1770,1024:5000 }" # mms 1755, 1024-5000 UDP
msb_ports_udp = "{ 1:65535 }" # msb 1-65535 UDP
# Streambox server 1770 UDP
#------------------------------------------------------------------------
# tables
#------------------------------------------------------------------------
# block these networks
table <martians> { 0.0.0.0/8, 10.0.0.0/8, 20.20.20.0/24, 127.0.0.0/8, \
169.254.0.0/16, 172.16.0.0/12, 192.0.2.0/24, 192.168.0.0/16, \
224.0.0.0/3, 255.255.255.255 }
##############################################################################
### Required order: options, normalization, queueing, translation, filtering.
##############################################################################
#------------------------------------------------------------------------
# options
#------------------------------------------------------------------------
# config
set block-policy return
set loginterface $ext_if
set skip on lo0
set optimization aggressive
#------------------------------------------------------------------------
# normalization
#------------------------------------------------------------------------
#scrub all reassemble tcp no-df
#scrub in all fragment reassemble
scrub out all random-id
#------------------------------------------------------------------------
# Queueing
#------------------------------------------------------------------------
# pendiente!
#------------------------------------------------------------------------
# translation, redirection
#------------------------------------------------------------------------
# network address translation
no nat on $ext_if from $lan_net to any port $proxy_serv
nat on $ext_if from $lan_net to any -> ($ext_if)
#rdr outgoing WWW requests to the squid (disable if you using wpad.dat)
#no rdr on $lan_if inet proto tcp from 192.168.1.250 to any port $proxy
#rdr on $lan_if inet proto tcp from any to any port www -> 127.0.0.1 port 3128
# remote administration RealVNC
#rdr on $ext_if proto tcp from any to any port $vnc_tcp_port -> $vnc_client port $vnc_tcp_port
# P2P
# MLDonkey web interfaz
rdr on $ext_if proto tcp from any to any port 4080 -> $mldonkey
#Bittorrent
rdr on $ext_if proto {tcp, udp} from any to any port $bittorrent -> $mldonkey
#Donkey2000
rdr on $ext_if proto {tcp, udp} from any to any port $donkey2000_udp -> $mldonkey
#------------------------------------------------------------------------
# firewall policy
#------------------------------------------------------------------------
# restrictive default rules
block all
block return-rst in $logopt on $ext_if proto tcp all
block return-icmp in $logopt on $ext_if proto udp all
block in $logopt on $ext_if proto icmp all
block out $logopt on $ext_if all
# trust localhost
pass in quick on lo0 all
pass out quick on lo0 all
# anti fake return-scans
block return-rst out on $ext_if proto tcp all
block return-rst in on $ext_if proto tcp all
block return-icmp out on $ext_if proto udp all
block return-icmp in on $ext_if proto udp all
# toy with script kiddies scanning us
block in $logopt quick proto tcp flags FUP/WEUAPRSF
block in $logopt quick proto tcp flags WEUAPRSF/WEUAPRSF
block in $logopt quick proto tcp flags SRAFU/WEUAPRSF
block in $logopt quick proto tcp flags /WEUAPRSF
block in $logopt quick proto tcp flags SR/SR
block in $logopt quick proto tcp flags SF/SF
#block in on $ext_if from any to <martians>
#"Block drop in quick" will kill the rdr rules above for the privnet
block drop in on $ext_if from <martians> to any
block drop out on $ext_if from any to <martians>
# Block ssh bruteforce attempts http://johan.fredin.info/openbsd/block_ssh_bruteforce.html
# special rule for ssh
pass in on $ext_if proto tcp from any to ($ext_if) port ssh \
flags S/SA keep state \
(max-src-conn-rate 3/30, overload <ssh-bruteforce> flush global)
# block the ssh bruteforce bastards
block drop in quick on $ext_if from <ssh-bruteforce>
# open firewall fully
# warning: insecure!
#pass in quick all
#pass out quick all
# Bloquear la ip de un equipo a un puerto especifico (DoS a Squid)
#block drop in quick on $lan_if inet proto tcp from 192.168.1.250 to any port 3128
# Bloquear la ip de un equipo completamente
#block drop in quick on $lan_if from 192.168.1.250
# allow permitted icmp
pass in inet proto icmp all icmp-type $icmp_types keep state
# allow permitted services
pass in on $ext_if inet proto tcp from any to any port $pubserv flags S/SA keep state
#pass in on {$lan_if $wifi_if} inet proto {tcp udp} from $lan_net to any port $lanserv keep state
pass in on $lan_if inet proto {tcp udp} from $lan_net to any port $lanserv keep state
#pass in on {$lan_if $wifi_if} inet proto {tcp udp} from $smb_net to any port $samba_ports keep state
pass in on $lan_if inet proto {tcp udp} from $smb_net to any port $samba_ports keep state
# allow ftp conections
#pass in on $ext_if inet proto tcp from any to any port $ftpserv flags S/SA keep state
#pass in on $ext_if inet proto tcp from any to any port ftp keep state
#pass in on $ext_if inet proto tcp from any to any port ftp-data keep state
#pass in on $ext_if inet proto tcp from any to any port > 65499 keep state
#pass in on $ext_if inet proto tcp from any to port {ftp, ftp-data} flags S/SA keep state
# allow permited vnc
pass in on $ext_if inet proto tcp from any to any port $vnc_tcp_port flags S/SA keep state
pass in on $lan_if inet proto tcp from $lan_net to any port $vnc_tcp_port keep state
# permit access between LAN hosts
#pass in from $lan_net to $lan_net keep state
#pass out from $lan_net to $lan_net keep state
# Permitimos Window Media Player a $streamers a puertos $rtsp_ports $mms_ports $msb_ports
# Nota: IE=proxy manual, WMP=proxy manual y puertos abiertos en el firewall.
pass in quick on $lan_if inet proto tcp from $streamers to any port $rtsp_ports_tcp flags S/SA keep state
pass in quick on $lan_if inet proto udp from $streamers to any port $rtsp_ports_udp
pass in quick on $lan_if inet proto tcp from $streamers to any port $mms_ports_tcp flags S/SA keep state
pass in quick on $lan_if inet proto udp from $streamers to any port $mms_ports_udp
pass in quick on $lan_if inet proto tcp from $streamers to any port >1024 flags S/SA keep state
#MSN Messenger port
pass in quick on $lan_if inet proto tcp from $msn_messenger to any port $msn_tcp_port flags S/SA keep state
pass in quick on $lan_if inet proto udp from $msn_messenger to any port $msn_udp_port
#pass in quick on $lan_if inet proto tcp from 192.168.1.122 to any port >1024 flags S/SA keep state
# MLDonkey web interfaz
pass in on $ext_if proto tcp from any to $mldonkey port 4080
# BitTorrent
pass in on $ext_if proto {tcp, udp} from any to $mldonkey port $bittorrent
# Donkey2000
pass in on $ext_if proto tcp from any to $mldonkey port $donkey2000_tcp flags S/SA keep state
pass in on $ext_if proto udp from any to $mldonkey port $donkey2000_udp
# permit full outbound access
# warning: potentially insecure. you may wish to lock down outbound access.
pass out from any to any keep state