Sample basic IPv4-only SOHO configuration

2026-05-14 14:08:44 -04:00
parent ca0ae3c5c5
commit 5438fc765f
3 changed files with 52 additions and 0 deletions
@@ -0,0 +1,4 @@
+external_card="em0"
+internal_card="bge0"
+
+
@@ -0,0 +1,41 @@
+include "cards.conf"
+
+set block-policy drop
+set loginterface external
+
+set skip on lo0
+set skip on lo
+
+# Unroutable networks:
+table <v4_priv_nets> { 127.0.0.0/8 192.168.0.0/16 172.16.0.0/12 10.0.0.0/8 192.88.99.0/24 198.18.0.0/15 }
+
+table <priv_nets> { 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8, 192.88.99.0/24 198.18.0.0/15 2001:db8::/32 3fff::/20 }
+
+nat on $external_card inet from !($external_card) -> ($external_card:0)
+nat-anchor "ftp-proxy/*"
+rdr-anchor "ftp-proxy/*"
+
+block drop in quick on external from <priv_nets>
+
+block drop in quick from <junk> # User defined junk table
+block drop out quick to <junk> # User defined junk table
+
+# Scrub stuff via a matchrule:
+match in all scrub ( random-id reassemble tcp fragment reassemble )
+
+
+# Start with a paranoid default:
+block all
+
+# ICMP is important, don't block it
+pass proto { icmp ipv4-icmp } keep state
+
+# DHCPv4 from ISP
+pass in quick on external inet proto udp to (external) port { 67, 68 }
+
+pass out all
+
+antispoof for internal
+antispoof for external
+
+pass in on internal all
@@ -0,0 +1,7 @@
+. ${rc_router_dir}/sample/basic_legacy/cards.conf
+
+add_v4_net ${internal_card} 0 main
+
+add_v4_isp ${external_card} dhcp 
+
+pf_config=${rc_router_dir}/sample/basic-legacy/pf.conf