# Interfaces
#
ext_if="ste1"
int_if1="ste0"
home_net1="192.168.1.0/24"
wall1="209.85.135.99"
wall3="192.168.1.250"
ssh_hosts="192.168.1.34"
# IP-Addresses
#
martian="{ 0.0.0.0/8,\
1.0.0.0/24,\
127.0.0.0/8,\
169.254.0.0/16,\
172.16.0.0/12,\
192.0.2.0/24,\
192.168.0.0/16,\
204.152.64.0/23,\
224.0.0.0/3,\
240.0.0.0/4,\
255.255.255.255/32 }"
services_tcp="{ ssh }"
services_tcp_misc="{ 2222, 5900 }"
#services_udp="{ domain }"
# =============================================================================
# Miscellaneous stuff
# =============================================================================
# limit no. of state entries
#
set limit { states 20000, frags 20000 }
# packet normalization is always a good idea
#
scrub out all
scrub in all
# NAT-rules
#
nat-anchor "ftp-proxy/*"
rdr-anchor "ftp-proxy/*"
rdr pass on $ext_if inet proto tcp from any to $ext_if port 2222 -> 192.168.1.34 port 22
nat on $ext_if from $home_net1 to any -> $ext_if
rdr pass on $int_if1 proto tcp from any to any port 21 -> 127.0.0.1 port 8021
# =============================================================================
# Packetfilter rules starting here
# =============================================================================
# Default policy is to block everything
#
anchor "ftp-proxy/*"
block out log all
block in log all
block return-rst out log inet proto tcp all
block return-rst in log inet proto tcp all
block return-icmp out log inet proto udp all
block return-icmp in log inet proto udp all
# Allow traffic on unfiltered interfaces
#
pass out quick on { lo0, $int_if1 } all
pass in quick on { lo0, $int_if1 } all
# =============================================================================
# common rules for all filtered interfaces
# =============================================================================
# silently drop some stuff to not clutter the logfiles
#
block return-rst in quick proto tcp from any to any port { 137, 139, 445 }
block return-icmp in quick proto udp from any to any port { 137, 138, 445 }
# silently drop TCP non-SYN packets (only SYNs create state)
#
block out quick proto tcp all flags /S
block in quick proto tcp all flags /S
# =============================================================================
# external interface (all external IPv4 traffic)
# =============================================================================
# block and log outgoing packets that don't have my address as source, they are
# either spoofed or something is misconfigured (NAT disabled, for instance),
# we want to be nice and don't send out garbage.
#
block out log quick on $ext_if inet from !$ext_if to any
# silently drop broadcasts (ADSL noise)
#
block in quick on $ext_if inet from any to { 255.255.255.255 }
# block and log incoming packets from reserved address space and invalid
# addresses, they are either spoofed or misconfigured, we can't reply to
# them anyway (hence, no return-rst).
#
block in log quick on $ext_if inet from $martian to any
antispoof for { lo0, $ext_if }
# ftp-proxy back
#pass in quick on $ext_if proto tcp from any port 20 to $ext_if port >= 49152 flags S/SA keep state
# ICMP
#
pass out on $ext_if inet proto icmp from $ext_if to any icmp-type 8 code 0 keep state
pass in on $ext_if inet proto icmp from any to any icmp-type 8 code 0 keep state
# UDP
#
pass out on $ext_if inet proto udp from $ext_if to any keep state
# TCP
#
pass out on $ext_if inet proto tcp from $ext_if to any flags S/SAFR modulate state
pass in on $ext_if inet proto tcp from any to $ext_if port $services_tcp flags S/SAFR keep state
