46 lines
1.7 KiB
Text
46 lines
1.7 KiB
Text
# options
|
|
set optimization normal
|
|
set block-policy return
|
|
set fingerprints "/etc/pf.os"
|
|
# definitions
|
|
pf_strict = "{ re0 wlan0 ue0 }"
|
|
ext_ifs = "{ re0 wlan0 ue0 }"
|
|
|
|
vm_if = "vnat0"
|
|
vm_net = "10.0.0.0/24"
|
|
|
|
table <goonlan> const { 192.168.100.0/24, 192.168.184.0/24, 192.168.55.0/24 }
|
|
icmp_types = "{ 0, 3, 4, 8, 11, 12 }"
|
|
# base rules
|
|
set skip on lo0
|
|
|
|
# translation
|
|
## VM networking
|
|
nat on re0 from $vm_if:network to any -> (re0)
|
|
nat on wlan0 from $vm_if:network to any -> (wlan0)
|
|
nat on ue0 from $vm_if:network to any -> (ue0)
|
|
|
|
# filter
|
|
## allow any outgoing traffic
|
|
pass out on pf_strict from any to any
|
|
## allow ICMP pings
|
|
pass in on $pf_strict inet proto icmp all icmp-type $icmp_types
|
|
# services (ssh, nfs, smb)
|
|
tcp_services = "{ ssh nfsd rpcbind 711 957 22000 21027 }"
|
|
udp_services = "{ nfsd rpcbind 711 957 22000 }"
|
|
# rules
|
|
## allow all incoming traffic, since they could be a response to outgoing connection
|
|
## but block our service ports, and then allow it only for goonlab
|
|
## DHCP
|
|
pass in quick on $pf_strict inet proto tcp from any port 67:68 to any port { 67 68 } keep state flags S/SA
|
|
pass in quick on $pf_strict inet proto udp from any port 67:68 to any port { 67 68 } keep state
|
|
## services
|
|
# if port is our service, and its coming from goonlan - allow
|
|
pass in quick on $pf_strict inet proto tcp from <goonlan> to any port $tcp_services keep state
|
|
pass in quick on $pf_strict inet proto udp from <goonlan> to any port $udp_services keep state
|
|
|
|
# if previous rule didn't matched, that implies packet coming
|
|
# not from goonlan, therefore block
|
|
block in log on $pf_strict inet proto tcp from any to any port $tcp_services
|
|
block in log on $pf_strict inet proto udp from any to any port $udp_services
|
|
|