# $OpenBSD: faq-example1,v 1.2 2003/08/06 16:04:45 henning Exp $
#
# Firewall for Home or Small Office
# http://www.openbsd.org/faq/pf/example1.html
#
# macros
int_if = "fxp0"
ext_if = "fxp1"
tcp_services = "{ 25, 80, 443, 444, 445, 22 }"
udp_services = "{ 1194 }"
#forbidden_ports_intif = "{ 25 }"
icmp_types = "echoreq"
priv_nets = "{ 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8 }"
# options
set block-policy return
set loginterface $ext_if
# scrub
scrub in all
# nat/rdr
#nat on $ext_if from $int_if to any -> 64.56.145.210/32
nat log on $ext_if from $int_if:network to any -> ($ext_if)
rdr on $int_if proto tcp from any to any port 80 -> 127.0.0.1 port 3128 #squid transparent proxy
rdr on $ext_if proto tcp from any to any port 3389 -> 10.0.0.100 port 3389 #hm backdoor, we control this with pf later
#rdr on $ext_if proto tcp from any to any port 993 -> 10.0.0.2 port 993 #imap over ssl to guardian01
# filter rules
block all
#allow everything from lo0 and tun0
pass quick on lo0 all
pass quick on tun0 all
#antispoof
block drop in quick on $ext_if from $priv_nets to any
block drop out quick on $ext_if from any to $priv_nets
pass in inet proto icmp all icmp-type $icmp_types keep state #we also accept some icmp messages
#fxp0 inbound
pass in quick on $ext_if inet proto tcp from any to ($ext_if) \
port $tcp_services flags S/SAFR keep state
pass in quick on $ext_if inet proto udp from any to ($ext_if) \
port $udp_services keep state
#allow our vendors to remote into our computers using rdp/vnc
pass in quick on $ext_if proto tcp from 66.46.110.252 to any port = 3389 keep state flags S/SAFR#hm
pass in quick on $ext_if proto tcp from 208.38.57.81 to any port = 5900 keep state flags S/SAFR#canem
#if the previous two rdp rules didnt let them through, quickly block them
block in quick on $ext_if proto tcp from any to any port 3389
block in quick on $ext_if proto tcp from any to any port 5900
#if they made it all the way down here then we should probably block them
block in quick on $ext_if from any to any
#fxp0 inbound
pass in on $int_if from $int_if:network to any keep state flags S/SAFR #default pass rule
#block port 25 unless its 10.0.0.2
pass in quick on $int_if proto tcp from 10.0.0.2 to any port = 25 keep state flags S/SAFR
#block return in quick on $int_if proto tcp from any to any port = 25
#a bunch of traffic we allow which we don't really need to since inbound rule says we allow it all anyway
pass in quick on $int_if proto tcp from 10.0.0.2 to any port = 80 keep state flags S/SAFR
pass in quick on $int_if proto tcp from 10.0.0.2 to any port = 443 keep state flags S/SAFR
pass in quick on $int_if proto tcp from 10.0.0.2 to any port = 53 keep state flags S/SAFR
pass in quick on $int_if proto tcp from 10.0.0.2 to any port = 13 keep state flags S/SAFR
pass in quick on $int_if proto udp from 10.0.0.2 to any port = 53 keep state
pass in quick on $int_if proto udp from 10.0.0.2 to any port = 123 keep state
pass in quick on $int_if proto tcp from 10.0.0.100 to any port = 3101 keep state flags S/SAFR
#fxp0 outbound, we don't really marshal this at all so the default pass rule is fine
pass out on $int_if from any to $int_if:network keep state flags S/SAFR
#fxp1 outbound, again we don't really marshal this
#pass out on $ext_if proto tcp all modulate state flags S/SAFR
pass out on $ext_if proto tcp all keep state flags S/SAFR
pass out on $ext_if proto { udp, icmp } all keep state