Changeset 10580 in hybrid for branches/releng-9.0/nanobsd/files/etc/pf.node.conf

Timestamp:

Apr 26, 2012, 11:14:59 AM (13 years ago)

Author:

rick

Message:

Cosmetics for pf.hybrid.conf and sync the pf.node.conf with needed rules, with
same format of pf.hybrid.conf.

(We might to inclusions using anchors) some-day to keep the rules synced, but
for now, just two files.

File:

• branches/releng-9.0/nanobsd/files/etc/pf.node.conf (modified) (2 diffs)

branches/releng-9.0/nanobsd/files/etc/pf.node.conf

@@ -1 @@
-# Table used to authorized hosts
+#
+# Wireless Leiden PF firewall configuration for iLeiden Node.
+#
+# N.B: The features points are shared between all firewall configurations to
+# make comparisions more easy to do 
+#
+# 5) The Wireless Leiden facing interfaces are not firewalled.
+# 6) WL Captive Portal Support for interfaces who needs it.
+# 9) Protect the Wireless Network from junk traffic.
+#
+# Rick van der Zwet <rick@wirelessleiden.nl>
+#
+wl_net="172.16.0.0/12"
+ileiden_ports="80,443"
+
+# Default configuration for ALIX2 with ue0 as public interface and wlan0 as
+# the public accesspoint in iLeiden setup. 
+captive_portal_interfaces="ue0, wlan0"
+
+# Table used to authorized hosts (6)
 table <wlportal> persist counters
 
@@ -5 +24 @@
 set block-policy return
 
-# Localhost is considered safe and should thus not be filtered
-set skip on lo0
+# Nat to the internet for packets which are orginating from itself for proxy functionality (8)
+nat on !$ext_if inet proto tcp from $wl_net to any port { $ileiden_ports } -> ($ext_if) 
 
-wl_net="172.16.0.0/12"
-#captive_ifs="vr0,vr1,vr2,ue0"
+# Redirect user to captive portal they have not clicked OK yet (6)
+no rdr on { $captive_portal_interfaces } proto tcp from <wlportal> to !$wl_net port 80
+rdr on { $captive_portal_interfaces } proto tcp from $wl_net to !$wl_net port 80 -> 172.31.255.1 port 8081
 
-# Redirect user to captive portal they have not clicked OK yet.
-no rdr on { $captive_portal_interfaces } proto tcp from <wlportal> to !$wl_net port 80
-rdr on { $captive_portal_interfaces } proto tcp from $wl_net to !$wl_net port 80 -> 127.0.0.1 port 8082
+# Localhost is considered safe (5)
+pass quick on lo0 all
 
-# Default allow
+# By default all interfaces are open (5)
 pass all
+
+# By default deny all outgoing traffic to avoid systems spamming the network (9)
+block out on { $captive_portal_interfaces } from any to !$wl_net
+
+# Note: not even HTTPS traffic allowed for those who has not clicked OK yet (6)
+pass out on { $captive_portal_interfaces } proto tcp from <wlportal> to !$wl_net port { $ileiden_ports } keep state