1 |
# http://www.vim.org/script.php?script_id=341 |
# http://www.vim.org/script.php?script_id=341 |
2 |
# http://www.openbsd.org/cgi-bin/man.cgi?query=pf.conf&apropos=0&sektion=0&manpath=OpenBSD+Current&arch=i386&format=html |
# http://www.openbsd.org/cgi-bin/man.cgi?query=pf.conf&apropos=0&sektion=0&manpath=OpenBSD+Current&arch=i386&format=html |
3 |
|
|
4 |
#ext_if = 'fxp0' # Internet |
ext_if = 'fxp0' # Internet |
5 |
#int_if = 'fxp1' # testlan |
int_if3 = 'fxp1' # testlan |
6 |
#testlan_real = "60.60.60.0/26" |
testlan_real = "60.60.60.0/26" |
7 |
#fw_testlan_real = "60.60.60.1" |
fw_testlan_real = "60.60.60.1" |
8 |
#fw_testlan6 = "3FFA:B80:840::/48" |
#fw_testlan6 = "3FFA:B80:840::/48" |
9 |
#blackbox6 = "3FFA:B80:83B:2::1" |
#blackbox6 = "3FFA:B80:83B:2::1" |
10 |
#testlan_mgmt = "192.168.101.86, 192.168.101.87, 192.168.101.88/28 |
#testlan_mgmt = "192.168.101.86, 192.168.101.87, 192.168.101.88/28 |
12 |
#curly_err = "192.168.1.1, 192.168.1.2 }" |
#curly_err = "192.168.1.1, 192.168.1.2 }" |
13 |
#set limit states 10000, frags 2000 |
#set limit states 10000, frags 2000 |
14 |
#set loginterface $ext_if |
#set loginterface $ext_if |
15 |
#set optimization aggressive |
set optimization aggressive |
16 |
#set timeout tcp.closing 300, other.first 100 |
set timeout {tcp.closing 300, tcp.opening 200} |
17 |
#scrub in all |
scrub in all |
18 |
#nat on $ext_if inet from $testlan to any -> $fw_testlan_real |
#nat on $ext_if inet from $testlan to any -> $fw_testlan_real |
19 |
block out log all |
block out log all |
20 |
pass in quick on lo0 from any to any port = 22 keep state |
pass in quick on lo0 from {toto, $tata} port {20, 30 } to any keep state |
21 |
pass in quick on lo0 from any to any proto tcp port {80, 70} keep state |
pass in quick on lo0 proto tcp from any port 22 <> 22 to any port {80, 70} keep state |
22 |
pass out quick on $lo0 all keep state |
pass out quick on $lo0 all keep state |
23 |
#antispoof log quick for $int_if inet |
#antispoof log quick for $int_if inet |
24 |
#pass in quick on $int_if inet all keep state |
#pass in quick on $int_if inet all keep state |