Вобщем шлюз, 2-а интерфейса + tun0 (PPPoE:ed0 и nat на ppp).
Нужно было uTorrent сделать только для нашего нижегородского кольца, а так всё обычно. FTP - Активный.
Вобщем жду предложений и чего угодно вообще. Мой первый фаер на pf.
Код: Выделить всё
ed0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
ether 00:c0:df:f2:36:08
media: Ethernet autoselect (10baseT/UTP)
rl0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
options=8<VLAN_MTU>
inet 192.168.10.1 netmask 0xffffff00 broadcast 192.168.10.255
ether 00:80:48:14:86:ee
media: Ethernet autoselect (100baseTX)
status: active
pflog0: flags=141<UP,RUNNING,PROMISC> mtu 33208
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
inet 127.0.0.1 netmask 0xff000000
tun0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1492
inet 89.109.49.112 --> 89.109.48.1 netmask 0xffffffff
Opened by PID 373Код: Выделить всё
################################################################################
# Глобальная конфигурация pf
set block-policy drop # Действие block будет молча отбрасывать пакеты
set debug urgent # Уровень отладки (none, urgent, misc, loud)
set fingerprints "/etc/pf.os" # Файл с информацией для пассивного определения системы передающей пакеты
set state-policy if-bound # Таблица состояний будет работать только на конкретном интерфейсе, с которого вошёл пакет.
################################################################################
# Интерфейсы
ext_if="tun"
lan_if="rl0"
################################################################################
# Описываем различные сети
table <my_networks> persist { 192.168.10.0/24 }
table <server_ips> persist { self }
table <server_lan_ip> persist { 192.168.10.1 }
table <dns_servers> persist { 213.177.96.1, 213.177.97.1 }
table <reserved_networks> persist { 0.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.0.2.0/24, 192.168.0.0/16, 169.254.0.0/16, 224.0.0.0/3 }
# ixnn
table <ixnn_vt_block> persist { 213.177.96.6/32, 213.177.96.8/32, 213.177.96.9/32, 213.177.96.221/32, 213.177.97.26/32 }
ixnn_sandy="193.125.70.0/23, 194.190.176.0/20, 195.122.224.0/19, 217.18.52.0/23, 91.194.192.0/23"
ixnn_ads="195.98.32.0/19, 212.92.128.0/18, 217.118.93.0/24, 89.189.0.0/19"
ixnn_nts="78.40.184.0/21, 217.23.16.0/20"
ixnn_nngu="85.143.0.0/20, 89.28.199.0/24"
ixnn_nis="212.67.0.0/19"
ixnn_pss="217.25.80.0/22, 85.91.192.0/21"
ixnn_vt="82.208.64.0/18, 89.109.0.0/18, 213.177.96.0/19"
# Все ixnn таблицы в одной
table <ixnn_all> persist { $ixnn_sandy $ixnn_ads $ixnn_nts $ixnn_nngu $ixnn_nis $ixnn_pss $ixnn_vt }
################################################################################
# Списки портов и icmp типов
utorrent="{ 59034 }"
tcp_ports_out="{ 21,22,25,80,110,443,5190 }"
for_lan_icmp_types="{0,8}"
for_lan_ports_tcp="{22}"
for_lan_ports_udp="{123}"
################################################################################
# Отключаем pf для локального интерфейса
set skip on lo
# Нормализация всего входящего трафика
scrub in all
# Отправляем трафик на squid
rdr on $lan_if inet proto tcp from <my_networks> to any port 80 -> 127.0.0.1 port 3128
# Типа защита от NMAP
block in log quick from any os NMAP
# Антиспуфинг
antispoof quick for $lan_if inet
################################################################################
# Входящий/Исходящий трафик нашей сети и сервера
# icmp
pass in quick on $lan_if inet proto icmp from <my_networks> to <server_lan_ip> icmp-type $for_lan_icmp_types keep state
# tcp
pass in quick on $lan_if inet proto tcp from <my_networks> to 127.0.0.1 port 3128
pass in quick on $lan_if inet proto tcp from <my_networks> to <server_lan_ip> port $for_lan_ports_tcp keep state
# udp
pass in quick on $lan_if inet proto udp from <my_networks> to <server_lan_ip> port $for_lan_ports_udp keep state
# От сервера в сеть всё разрешено
pass out quick on $lan_if inet from <server_lan_ip> to any modulate state
################################################################################
# Входящий/Исходящий трафик нашей сети и интернет
# Блокируем зарезервированные сети (Нужные пропущены правилами выше)
block in quick on $lan_if inet from any to <reserved_networks>
block in quick on $ext_if inet from <reserved_networks> to any
# icmp
pass in quick on $lan_if inet proto icmp from <my_networks> to any icmp-type 8 keep state
pass out quick on $ext_if inet proto icmp from <my_networks> to any icmp-type 8 keep state
# tcp
# uTorrent (блокируем исключения в ixnn)
block in quick on $lan_if inet proto tcp from <my_networks> port $utorrent to <ixnn_vt_block>
block in quick on $ext_if inet proto tcp from { <ixnn_vt_block>, ! <ixnn_all> } to <my_networks> port $utorrent
# uTorrent
pass in quick on $lan_if inet proto tcp from <my_networks> port $utorrent to <ixnn_all> keep state
pass out quick on $ext_if inet proto tcp from <my_networks> port $utorrent to <ixnn_all> keep state
# Разрешённые TCP порты наружу
pass in quick on $lan_if inet proto tcp from <my_networks> to <ixnn_all> keep state
pass out quick on $ext_if inet proto tcp from <my_networks> to <ixnn_all> keep state
pass in quick on $lan_if inet proto tcp from <my_networks> to any port $tcp_ports_out keep state
pass out quick on $ext_if inet proto tcp from <my_networks> to any port $tcp_ports_out keep state
# Разрешённые TCP порты во внутрь
pass in quick on $ext_if inet proto tcp from <ixnn_all> to <my_networks> port $utorrent keep state
pass out quick on $lan_if inet proto tcp from <ixnn_all> to <my_networks> port $utorrent keep state
pass in quick on $ext_if inet proto tcp from any port 20 to <my_networks> keep state flags S/SA
pass out quick on $lan_if inet proto tcp from any port 20 to <my_networks> keep state flags S/SA
# udp
# Наш DNS
pass in quick on $lan_if inet proto udp from <my_networks> to <dns_servers> port 53 keep state
pass out quick on $ext_if inet proto udp from <my_networks> to <dns_servers> port 53 keep state
#############################################################
# Входящий/Исходящий трафик сервера и интернет
# От сервера в инет всё разрешено
pass out quick on $ext_if inet from <server_ips> to any modulate state
#############################################################
# Всякая ботва, чтобы логи не захломляли
block in quick on $ext_if inet proto { tcp , udp } from any to any port {137:139, 445}
# Убиваем всё остальное
block log-all quick all
Код: Выделить всё
scrub in all fragment reassemble
block drop in log quick from any os "NMAP" to any
block drop in quick on ! rl0 inet from 192.168.10.0/24 to any
block drop in quick inet from 192.168.10.1 to any
pass in quick on rl0 inet proto icmp from <my_networks> to <server_lan_ip> icmp-type echorep keep state (if-bound)
pass in quick on rl0 inet proto icmp from <my_networks> to <server_lan_ip> icmp-type echoreq keep state (if-bound)
pass in quick on rl0 inet proto tcp from <my_networks> to 127.0.0.1 port = 3128
pass in quick on rl0 inet proto tcp from <my_networks> to <server_lan_ip> port = ssh keep state (if-bound)
pass in quick on rl0 inet proto udp from <my_networks> to <server_lan_ip> port = ntp keep state (if-bound)
pass out quick on rl0 inet from <server_lan_ip> to any modulate state (if-bound)
block drop in quick on rl0 inet from any to <reserved_networks>
block drop in quick on tun inet from <reserved_networks> to any
pass in quick on rl0 inet proto icmp from <my_networks> to any icmp-type echoreq keep state (if-bound)
pass out quick on tun inet proto icmp from <my_networks> to any icmp-type echoreq keep state (if-bound)
block drop in quick on rl0 inet proto tcp from <my_networks> port = 59034 to <ixnn_vt_block>
block drop in quick on tun inet proto tcp from <ixnn_vt_block> to <my_networks> port = 59034
block drop in quick on tun inet proto tcp from ! <ixnn_all> to <my_networks> port = 59034
pass in quick on rl0 inet proto tcp from <my_networks> port = 59034 to <ixnn_all> keep state (if-bound)
pass out quick on tun inet proto tcp from <my_networks> port = 59034 to <ixnn_all> keep state (if-bound)
pass in quick on rl0 inet proto tcp from <my_networks> to <ixnn_all> keep state (if-bound)
pass out quick on tun inet proto tcp from <my_networks> to <ixnn_all> keep state (if-bound)
pass in quick on rl0 inet proto tcp from <my_networks> to any port = ftp keep state (if-bound)
pass in quick on rl0 inet proto tcp from <my_networks> to any port = ssh keep state (if-bound)
pass in quick on rl0 inet proto tcp from <my_networks> to any port = smtp keep state (if-bound)
pass in quick on rl0 inet proto tcp from <my_networks> to any port = http keep state (if-bound)
pass in quick on rl0 inet proto tcp from <my_networks> to any port = pop3 keep state (if-bound)
pass in quick on rl0 inet proto tcp from <my_networks> to any port = https keep state (if-bound)
pass in quick on rl0 inet proto tcp from <my_networks> to any port = aol keep state (if-bound)
pass out quick on tun inet proto tcp from <my_networks> to any port = ftp keep state (if-bound)
pass out quick on tun inet proto tcp from <my_networks> to any port = ssh keep state (if-bound)
pass out quick on tun inet proto tcp from <my_networks> to any port = smtp keep state (if-bound)
pass out quick on tun inet proto tcp from <my_networks> to any port = http keep state (if-bound)
pass out quick on tun inet proto tcp from <my_networks> to any port = pop3 keep state (if-bound)
pass out quick on tun inet proto tcp from <my_networks> to any port = https keep state (if-bound)
pass out quick on tun inet proto tcp from <my_networks> to any port = aol keep state (if-bound)
pass in quick on tun inet proto tcp from <ixnn_all> to <my_networks> port = 59034 keep state (if-bound)
pass out quick on rl0 inet proto tcp from <ixnn_all> to <my_networks> port = 59034 keep state (if-bound)
pass in quick on tun inet proto tcp from any port = ftp-data to <my_networks> flags S/SA keep state (if-bound)
pass out quick on rl0 inet proto tcp from any port = ftp-data to <my_networks> flags S/SA keep state (if-bound)
pass in quick on rl0 inet proto udp from <my_networks> to <dns_servers> port = domain keep state (if-bound)
pass out quick on tun inet proto udp from <my_networks> to <dns_servers> port = domain keep state (if-bound)
pass out quick on tun inet from <server_ips> to any modulate state (if-bound)
block drop in quick on tun inet proto tcp from any to any port 137:139
block drop in quick on tun inet proto tcp from any to any port = microsoft-ds
block drop in quick on tun inet proto udp from any to any port 137:139
block drop in quick on tun inet proto udp from any to any port = microsoft-ds
block drop log-all quick all
