pf.conf
Код: Выделить всё
ext_if="rl0"
int_if="re0"
icmp_types="echoreq"
proxy_if="xxx.xxx.xxx.xxx"
proxy_port="3128"
admin="xxx.xxx.xxx.xxx"
tcp_out = "25,110,465, 80"
non_route_nets_inet="{ 172.16.0.0/12, 169.254.0.0/16, 240.0.0.0/4 }"
table <bruteforce> persist file "/var/log/bruteforce"
set block-policy drop
set skip on lo0
set timeout { frag 10, tcp.established 3600 }
scrub in all
nat on $ext_if from $int_if:network to !(self) -> ($ext_if)
block all
antispoof log quick for { lo0, $int_if, $ext_if }
block drop in log quick on $ext_if from $non_route_nets_inet to any
block drop in log quick on $int_if from !$int_if:network to any
block drop in log quick on { $int_if, $ext_if } proto tcp from any to any port smtp
block drop quick from <bruteforce>
pass in on $int_if proto udp from $int_if:network to any port domain queue qdns keep state
pass in quick on $int_if inet proto tcp from $int_if:network to any port { $tcp_out } keep state
pass in on $int_if proto tcp from { $admin } to $int_if port ssh queue ( qssh, qack ) synproxy state ( max-src-conn-rate 5/360, overload <bruteforce> flush global )
pass in on $int_if proto tcp from $int_if:network to $proxy_if port $proxy_port
pass out on $ext_if modulate state
pass in inet proto icmp all icmp-type $icmp_types keep state
