forum.lissyara.su

Код: Выделить всё

ext_if="em0"
int_if="em1"
local_if="lo0"
trusted_lan="172.16.10.0/24"
alpha="172.16.10.101"
vserver="172.16.10.100"
noroute="{ 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8 }"
tcp_services="{ 22, 21, 80, 443 }"
icmp_types="echoreq"

table <badhosts> persist
table <users> { 172.16.10.0/24 !172.16.10.100, !172.16.10.101, !172.16.10.102, !172.16.10.103 }
table <clients> persist file "/etc/clients"

set block-policy return
set loginterface $ext_if
set skip on $int_if
set skip on lo

scrub in all fragment reassemble

rdr on $int_if proto tcp from <clients> to any port www -> 127.0.0.1 port 3128
nat on $ext_if from $trusted_lan to any -> ($ext_if)

block all
block inet6 all
block in quick from any os NMAP
block drop in quick from <badhosts>
block in quick on $ext_if inet from $noroute to any
block out quick on $ext_if inet from any to $noroute
block drop in quick on $ext_if proto tcp from any port { 135 136 137 138 139 445 1433 } to any
block drop in quick on $ext_if proto udp from any port { 135 136 137 138 139 445 1434 } to any

### Block bad tcp flags from malicious people and nmap scans

block in log quick on $ext_if proto tcp from any to any flags /S
block in log quick on $ext_if proto tcp from any to any flags /SFRA
block in log quick on $ext_if proto tcp from any to any flags /SFRAU
block in log quick on $ext_if proto tcp from any to any flags A/A
block in log quick on $ext_if proto tcp from any to any flags F/SFRA
block in log quick on $ext_if proto tcp from any to any flags U/SFRAU
block in log quick on $ext_if proto tcp from any to any flags SF/SF
block in log quick on $ext_if proto tcp from any to any flags SF/SFRA
block in log quick on $ext_if proto tcp from any to any flags SR/SR
block in log quick on $ext_if proto tcp from any to any flags FUP/FUP
block in log quick on $ext_if proto tcp from any to any flags FUP/SFRAUPEW
block in log quick on $ext_if proto tcp from any to any flags SFRAU/SFRAU
block in log quick on $ext_if proto tcp from any to any flags SFRAUP/SFRAUP

antispoof quick for $ext_if inet

pass in on $ext_if inet proto tcp from any to $ext_if flags S/SA keep state
pass out on $ext_if from $ext_if to any keep state
pass out on $ext_if from $trusted_lan to any keep state
pass in on $int_if proto tcp from $trusted_lan to $int_if port ssh keep state \
   (max-src-conn 100, max-src-conn-rate 5/300, overload <badhosts> flush)
pass in on $ext_if proto tcp from any to $ext_if port ssh keep state \
   (max-src-conn 100, max-src-conn-rate 5/300, overload <badhosts> flush)
pass log inet proto icmp all icmp-type $icmp_types keep state

Код: Выделить всё

# tcpdump -netttvvvi pflog0 | grep block

Код: Выделить всё

rdr pass on $int_if proto tcp from <clients> to any port www -> 127.0.0.1 port 3128