I've been playing around with pf(4) for the last few days trying to get everything setup the way I want it, and I think I've almost got it, but there's a few things I'd like to check with you guys about.
First, about my setup. A FreeBSD 10.1 machine with two network IFs acting as a gateway/router. re1 is the internal IF at 10.0.0.1 and re0/tun0 is the external IF with the site's IP address. Two ports, 80 and 22 are open to inbound connections from the internet. The machine itself is running http, ftpd, sshd, telnetd, named, nfsd, dhcpd, Samba, ntpd, and qpopper. Except for httpd, sshd, and maybe ftpd and qpopper, none of those services need to be visible to the internet.
Here's a copy of my pf.conf
Right now it's blocking all incoming connections from the net except 22, 80, and ICMP echo, while allowing unlimited access to itself and outbound connections to the LAN. Since all of the machines on the LAN are trustworthy, I'd like to keep allowing unlimited traffic to the server from the LAN, but I'd like to block all incoming connections to the LAN and outgoing connections to the internet from the LAN and server except: ftp, ssh, telnet, smtp, http, pop3, sftp, ntp, imap, https, UDP ports 5001, and 5060-5070. I'd also like to block DNS and pop3/imap requests from the LAN to the internet, since the server/router takes care of forwarding/caching DNS and downloading mail. So far I haven't found a way to do all this without screwing everything else up.
I should also mention that I'm having a small problem with FTP Proxy, right now I can only get it to work by specifying the external interface's address (proxy = "184.13.32.35 port 8021"), which is a problem since it's a dynamic IP.
First, about my setup. A FreeBSD 10.1 machine with two network IFs acting as a gateway/router. re1 is the internal IF at 10.0.0.1 and re0/tun0 is the external IF with the site's IP address. Two ports, 80 and 22 are open to inbound connections from the internet. The machine itself is running http, ftpd, sshd, telnetd, named, nfsd, dhcpd, Samba, ntpd, and qpopper. Except for httpd, sshd, and maybe ftpd and qpopper, none of those services need to be visible to the internet.
Here's a copy of my pf.conf
Code:
# Macros
int_if = "re1"
ext_if = "tun0"
localnet = $int_if:network
tcp_svc = "{ 80, 22 }"
icmp_types = "echoreq"
proxy = "184.13.32.35 port 8021"
# Security
scrub in all fragment reassemble no-df max-mss 1440
# Network address translation
nat on $ext_if from $localnet to any -> ($ext_if)
nat-anchor "ftp-proxy/*"
rdr-anchor "ftp-proxy/*"
rdr pass on $int_if proto tcp from $localnet to any port 21 -> \
127.0.0.1 port 8021
# Rules
block all
pass inet proto icmp all icmp-type $icmp_types keep state
# Allow all internally initiated network traffic
pass inet proto tcp from { self, $localnet }
pass inet proto udp from { self, $localnet }
# Allow select services
pass in inet proto tcp to $ext_if port $tcp_svc
# Block private bound traffic on ext if
private = "{ 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, \
10.0.0.0/8, 169.254.0.0/16, 192.0.2.0/24, \
0.0.0.0/8, 240.0.0.0/4 }"
block drop in quick on $ext_if from $private to any
block drop out quick on $ext_if from any to $private
# More security
antispoof for $ext_if
table <bruteforce> persist
block quick from <bruteforce>
pass inet proto tcp to $localnet port $tcp_svc \
keep state (max-src-conn 100, max-src-conn-rate 15/5, \
overload <bruteforce> flush global)
# FTP Issues
anchor "ftp-proxy/*"
pass out proto tcp from $proxy to any port 21I should also mention that I'm having a small problem with FTP Proxy, right now I can only get it to work by specifying the external interface's address (proxy = "184.13.32.35 port 8021"), which is a problem since it's a dynamic IP.
Last edited by a moderator: