Home | History | Annotate | Line # | Download | only in npf
l2tp_gw-npf.conf revision 1.2.4.2 
      1 # ex0 - (internal) network interface
      2 #	192.168.2.254/24
      3 # hme0 - (external) connection to Two Sigma
      4 #	74.66.0.142/24
      5 
      6 $int_if = "sk0"
      7 $ext_if = "bge0"
      8 
      9 alg "icmp"
     10 
     11 #
     12 # NAT for all.
     13 #
     14 map $ext_if dynamic 192.168.1.0/24 -> inet4($ext_if)
     15 
     16 #table <1> type tree file "/etc/npf_problem_sites"
     17 
     18 procedure "log" {
     19 	log: npflog0
     20 }
     21 
     22 group "external" on $ext_if {
     23 	#
     24 	# Allow DHCP requests (even to reserved addresses).
     25 	#
     26 	pass out final proto udp from any port bootpc to any port bootps
     27 	pass in final proto udp from any port bootps to any port bootpc
     28 	pass in final proto udp from any port bootps to 255.255.255.255 port bootpc
     29 	#
     30 	# Allow DNS queries
     31 	#
     32 	pass stateful out final proto udp to any port domain
     33 
     34 	# Problem sites.
     35 	#block in final from <1> apply "log"
     36 
     37 	#
     38 	# Block IANA-reserved addresses from entering or exiting
     39 	#
     40 	block in final from 10.0.0.0/8 apply "log"
     41 	block in final from 172.16.0.0/12 apply "log"
     42 	block in final from 192.168.0.0/16 apply "log"
     43 	#
     44 	block out final to 10.0.0.0/8 apply "log"
     45 	block out final to 172.16.0.0/12 apply "log"
     46 	block out final to 192.168.0.0/16 apply "log"
     47 	#
     48 	pass stateful out final proto tcp all
     49 	pass stateful out final proto udp all
     50 	pass stateful out final proto icmp all
     51 	pass stateful out final proto ipv6-icmp all
     52 
     53 	block in final proto tcp to 192.168.2.255 apply "log"
     54 
     55 	#
     56 	# Prevent IP spoofing attacks on the firewall.
     57 	#
     58 	block in final from 127.0.0.1 apply "log"
     59 
     60 	#
     61 	# L2TP/IPSEC-NAT-T Tunnels.
     62 	#
     63 	pass in final proto udp from any to inet4($ext_if) port isakmp
     64 	pass in final proto esp from any to inet4($ext_if)
     65 	pass out final proto esp from any to inet4($ext_if)
     66 	pass in final proto ah from any to inet4($ext_if)
     67 	pass in final from any to inet4($ext_if) port "ipsec-nat-t"
     68 
     69 	#
     70 	# Pass multicast.
     71 	# IGMP uses 224.0.0.1.
     72 	#
     73 	pass in final proto igmp all
     74 	pass in final from any to 224.0.0.0/4
     75 
     76 	#
     77 	# Pass established connections.
     78 	#
     79 	pass in final proto tcp flags A/A all
     80 	pass in final proto tcp flags R/R all
     81 	#
     82 	# VNC
     83 	#
     84 	pass in final proto tcp from any to any port 5500
     85 
     86 	#
     87 	# Web servers
     88 	#
     89 	#pass in final proto tcp from any to <A>/<M> port http
     90 
     91 	#
     92 	# Services on localhost.
     93 	#
     94 	#pass in final proto udp from any port ntp
     95 	#pass in final to any port imap
     96 	#pass in final to any port domain
     97 	#pass in final proto tcp to any port smtp
     98 	#pass in final proto tcp to any port auth
     99 	#pass in final proto tcp to any port ssh
    100 	#pass in final proto tcp to any port bgp
    101 	#pass in final proto tcp to any port ftp
    102 	#pass in final proto tcp to any port "ftp-data"
    103 	#pass in final proto udp to any port isakmp
    104 	#pass in final proto udp to any port 8001
    105 	#pass in final proto tcp to inet4($ext_if) port www
    106 
    107 	#
    108 	# Handle traceroute gracefully for up-to 30 hops away.
    109 	# FIXME: port-unr for ICMP is not yet supported.
    110 	#
    111 	block return-icmp in final proto udp to any port 33433-33524 apply "log"
    112 
    113 	#
    114 	# Only allow selected ICMP types.
    115 	#
    116 	pass in final proto icmp icmp-type echo all
    117 	pass in final proto icmp icmp-type timxceed all
    118 	pass in final proto icmp icmp-type unreach all
    119 	pass in final proto icmp icmp-type echoreply all
    120 	pass in final proto icmp icmp-type sourcequench all
    121 	pass in final proto icmp icmp-type paramprob all
    122 	pass in final proto ipv6-icmp all
    123 
    124 	#
    125 	# Send back a reset for new connections on tcp.
    126 	#
    127 	block return-rst in final proto tcp flags S/SA all apply "log"
    128 }
    129 
    130 group "internal" on $int_if {
    131 	# Pass everything to internal networks,
    132 	# should be ok, because we are nat'ed.
    133 	pass final all
    134 }
    135 
    136 group default {
    137 	# Loopback interface should allows packets to traverse it.
    138 	pass final on lo0 all
    139 	# For one L2TP tunnel, needs interface pre-created, post-destroyed
    140 	pass final on ppp0 all
    141 
    142 	#
    143 	# Block everything by default.
    144 	#
    145 	block final all apply "log"
    146 }
    147