# cat rules.debug
# System Aliases
loopback = "{ lo0 }"
lan = "{ re0 }"
ng0 = "{ fxp1 ng0 }"
wan = "{ fxp1 ng0 }"
WAN2 = "{ fxp2 }"
# User Aliases
set loginterface fxp1
set loginterface re0
set loginterface fxp2
set optimization normal
scrub on ng0 all random-id max-mss 1452 fragment reassemble
# UPnPd rdr anchor
rdr-anchor "upnpd/*"
nat-anchor "pftpx/*"
nat-anchor "natearly/*"
nat-anchor "natrules/*"
# FTP proxy
rdr-anchor "pftpx/*"
nat on $ng0 from 10.0.0.0/24 port 500 to any port 500 -> (ng0) port 500
nat on $ng0 from 10.0.0.0/24 to any -> (ng0)
nat on $WAN2 from 10.0.0.0/24 to any -> (fxp2)
#SSH Lockout Table
table <sshlockout> persist
# Load balancing anchor - slbd updates
rdr-anchor "slb"
# FTP Proxy/helper
rdr on $lan proto tcp from any to any port 21 -> 127.0.0.1 port 8021
rdr on $WAN2 proto tcp from any to any port 21 -> 127.0.0.1 port 8022
rdr on re0 inet proto tcp to !(re0) port 80 -> (re0) port 3128
pass quick on re0 inet proto tcp to !(re0) port 80 flags S/SA keep state
anchor "ftpsesame/*"
anchor "firewallrules"
# loopback
anchor "loopback"
pass in quick on $loopback all label "pass loopback"
pass out quick on $loopback all label "pass loopback"
# package manager early specific hook
anchor "packageearly"
# carp
anchor "carp"
# enable ftp-proxy
pass in quick on fxp2 inet proto tcp from any to $loopback port 8022 keep state label "FTP PROXY: Allow traffic to localhost"
pass in quick on fxp2 inet proto tcp from any to $loopback port 21 keep state la bel "FTP PROXY: Allow traffic to localhost"
anchor "ftpproxy"
anchor "pftpx/*"
pass in quick on re0 inet proto tcp from any to $loopback port 8021 keep state l abel "FTP PROXY: Allow traffic to localhost"
pass in quick on re0 inet proto tcp from any to $loopback port 21 keep state lab el "FTP PROXY: Allow traffic to localhost"
pass in quick on ng0 inet proto tcp from port 20 to (ng0) port > 49000 user prox y flags S/SA keep state label "FTP PROXY: PASV mode data connection"
# NAT Reflection rules
# allow access to DHCP server on LAN
anchor "dhcpserverlan"
pass in quick on $lan proto udp from any port = 68 to 255.255.255.255 port = 67 label "allow access to DHCP server on LAN"
pass in quick on $lan proto udp from any port = 68 to 10.0.0.29 port = 67 label "allow access to DHCP server on LAN"
pass out quick on $lan proto udp from 10.0.0.29 port = 67 to any port = 68 label "allow access to DHCP server on LAN"
block in log quick on $wan proto udp from any port = 67 to 10.0.0.0/24 port = 68 label "allow dhcp client out wan"
pass in quick on $wan proto udp from any port = 67 to any port = 68 label "allow dhcp client out wan"
# LAN/OPT spoof check (needs to be after DHCP because of broadcast addresses)
antispoof for re0
antispoof for fxp2
# block anything from private networks on WAN interface
anchor "spoofing"
block in log quick on $wan from 10.0.0.0/8 to any label "block private networks from wan block 10/8"
block in log quick on $wan from 127.0.0.0/8 to any label "block private networks from wan block 127/8"
block in log quick on $wan from 172.16.0.0/12 to any label "block private networ ks from wan block 172.16/12"
block in log quick on $wan from 192.168.0.0/16 to any label "block private netwo rks from wan block 192.168/16"
# Support for allow limiting of TCP connections by establishment rate
anchor "limitingesr"
table <virusprot>
block in quick from <virusprot> to any label "virusprot overload table"
# let out anything from the firewall host itself and decrypted IPsec traffic
pass out quick on ng0 all keep state label "let out anything from firewall host itself"
# pass traffic from firewall -> out
anchor "firewallout"
pass out quick on { fxp1 ng0 } all keep state label "let out anything from fir ewall host itself"
pass out quick on re0 all keep state label "let out anything from firewall host itself"
pass out quick on fxp2 all keep state label "let out anything from firewall host itself"
# let out anything from the firewall host itself and decrypted IPsec traffic
pass out quick on fxp2 all keep state label "let out anything from firewall host itself"
# make sure the user cannot lock himself out of the webGUI or SSH
anchor "anti-lockout"
pass in quick from 10.0.0.0/24 to 10.0.0.29 keep state label "anti-lockout web r ule"
# SSH lockout
block in log proto tcp from <sshlockout> to any port 22 label "sshlockout"
# User-defined rules follow
pass in quick on $lan route-to ( fxp2 192.168.7.1 ) from { 10.0.0.12 } to any keep state label "USER_RULE: Uberworx -> Secondary Wan"
pass in quick on $lan from 10.0.0.0/24 to any keep state label "USER_RULE: Defa ult LAN -> any"
# VPN Rules
#---------------------------------------------------------------------------
# default rules (just to be sure)
#---------------------------------------------------------------------------
block in log quick all label "Default block all just to be sure."
block out log quick all label "Default block all just to be sure."