45 lines
1.1 KiB
Plaintext
45 lines
1.1 KiB
Plaintext
include "local.conf"
|
|
|
|
set block-policy drop
|
|
set loginterface external
|
|
|
|
set skip on lo0
|
|
set skip on lo
|
|
|
|
# Unroutable networks:
|
|
table <v4_priv_nets> { 127.0.0.0/8 192.168.0.0/16 172.16.0.0/12 10.0.0.0/8 192.88.99.0/24 198.18.0.0/15 }
|
|
|
|
table <priv_nets> { 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8, 192.88.99.0/24 198.18.0.0/15 2001:db8::/32 3fff::/20 }
|
|
|
|
nat on $external_card inet from !($external_card) -> ($external_card:0)
|
|
nat-anchor "ftp-proxy/*"
|
|
rdr-anchor "ftp-proxy/*"
|
|
|
|
block drop in quick on external from <priv_nets>
|
|
|
|
block drop in quick from <junk> # User defined junk table
|
|
block drop out quick to <junk> # User defined junk table
|
|
|
|
# Scrub stuff via a matchrule:
|
|
match in all scrub ( random-id reassemble tcp fragment reassemble )
|
|
|
|
|
|
# Start with a paranoid default:
|
|
block all
|
|
|
|
# ICMP is important, don't block it
|
|
pass proto { icmp ipv4-icmp } keep state
|
|
|
|
# DHCPv4 from ISP
|
|
pass in quick on external inet proto udp to (external) port { 67, 68 }
|
|
|
|
# DHCPv6 and NDP with ISP
|
|
pass in quick on external inet6 proto udp to fe80::/64 port 546
|
|
|
|
pass out all
|
|
|
|
antispoof for internal
|
|
antispoof for external
|
|
|
|
pass in on internal all
|