Changeset 10417 in hybrid for branches/releng-9.0/nanobsd/files/etc/pf.conf

Timestamp:

Apr 10, 2012, 2:51:13 PM (13 years ago)

Author:

rick

Message:

Merging and cleanups of files found in various other places and trees of SVN.

File:

• branches/releng-9.0/nanobsd/files/etc/pf.conf (modified) (4 diffs)

branches/releng-9.0/nanobsd/files/etc/pf.conf

@@ -1 @@
-wifi_if="wlan0"
 all_node="172.31.255.1/32"
-
 wl_net="172.16.0.0/12"
-vpn_net="172.17.64.0/28"
 allow_ext_tcp="{22}"
 allow_ext_udp="{161}"
-allow_int_tcp="{22,53,80,3128}"
-allow_int_udp="{53,131,161,12345}"
+allow_int_tcp="{22,3128}"
+allow_int_udp="{53,161,12345}"
 allow_int_udp_any="{67}"
 
@@ -18 +15 @@
 nat on $int_if from $private to $wl_net -> ($int_if)
 
+# Redirection, needs source natting and allow rules
+#rdr on $ext_if inet proto tcp from any to $ext_if port 1022 -> 192.168.84.1 port 22    
+
 # Block all
-block in on $ext_if
-pass in on $int_if
+block in on $ext_if from any to $ext_if
+block in on $int_if from any to $int_if
 
-# Allow wl access from access point (not yet reversed)
-pass on $wifi_if from $wl_net to $wl_net
-
-# Block this device from wifi
-block in on $wifi_if inet from any to $wifi_if
-block inet from any to $all_node
-
+# Allow private to private
 # Enable me to access anything
-pass out on {$ext_if, $int_if, $wifi_if} keep state
+pass out on {$ext_if, $int_if} keep state
 
 # Allow internet access from the network
-pass in on $wifi_if inet proto tcp from $wl_net to any port $publicnat keep state
-block in on $wifi_if inet proto tcp from $wl_net to $wifi_if port $publicnat
-block in on $wifi_if inet proto tcp from $wl_net to $all_node port $publicnat
+pass in on $int_if inet proto tcp from $wl_net to any port $publicnat keep state
+block in on $int_if inet proto tcp from $wl_net to $int_if port $publicnat
 
 # Allow directives 
@@ -41 +34 @@
 pass in on $ext_if inet proto udp from any to $ext_if port $allow_ext_udp keep state
 
-pass in on $int_if inet proto tcp from $wl_net to $vpn_net port $allow_int_tcp keep state
-pass in on $int_if inet proto udp from $wl_net to $vpn_net port $allow_int_udp keep state
-pass in on $int_if inet proto icmp from $wl_net to $vpn_net keep state
-pass in on $int_if inet proto udp from any to any port $allow_int_udp_any keep state
-
-pass in on $wifi_if inet proto tcp from $wl_net to $wl_net port $allow_int_tcp keep state
-pass in on $wifi_if inet proto udp from $wl_net to $wl_net port $allow_int_udp keep state
-pass in on $wifi_if inet proto icmp from $wl_net to $wl_net keep state
-pass in on $wifi_if inet proto udp from any to any port $allow_int_udp_any keep state
+pass in on $int_if inet proto tcp from $wl_net to $int_if port $allow_int_tcp keep state
+pass in on $int_if inet proto udp from $wl_net to $int_if port $allow_int_udp keep state
+pass in on $int_if inet proto icmp from $wl_net to $int_if keep state
 
 # Allow wl access from local network
@@ -55 +42 @@
 
 # Make sure to block local network access from wl
-block on $wifi_if from $wl_net to $private
 block on $int_if from $wl_net to $private
 
+# Otherwise lvrouted breaks:
+pass in on $int_if