forum.lissyara.su

Код: Выделить всё

ext_if = "ng0"
        int_if = "dc0"

set loginterface $ext_if

scrub out on $ext_if  all min-ttl 128 fragment reassemble random-id
scrub out on $int_if  all min-ttl 128 fragment reassemble random-id
scrub in all fragment reassemble 
scrub    all reassemble tcp


#nat
nat on $ext_if  from 192.168.5.0/24 to any   -> ($ext_if)

set skip on lo0

#lan
antispoof quick for $int_if
  ##in
block in on $int_if all

        block in quick on $int_if proto tcp flags FUP/WEUAPRSF
        block in quick on $int_if proto tcp flags WEUAPRSF/WEUAPRSF
        block in quick on $int_if proto tcp flags SRAFU/WEUAPRSF
        block in quick on $int_if proto tcp flags /WEUAPRSF
        block in quick on $int_if proto tcp flags SR/SR
        block in quick on $int_if proto tcp flags SF/SF

pass in quick on $int_if proto tcp from $int_if:network to $int_if port 55599 #ssh
pass in quick on $int_if proto gre from $int_if:network to $int_if            #mpd
pass in quick on $int_if proto tcp from $int_if:network to $int_if port 1723  #mpd
pass in quick on $int_if proto tcp from $int_if:network to $int_if port {139, 445} #samba
pass in quick on $int_if proto udp from $int_if:network to $int_if port {137, 138} #samba 
pass in quick on $int_if inet proto icmp all icmp-type { echoreq, unreach } keep state #icmp
##out
pass out quick on $int_if from $int_if to $int_if:network 

#vpn_inet
  ##in
block in on $ext_if all
pass in quick on $ext_if inet proto icmp all icmp-type { echoreq, unreach } keep state
pass in quick on $ext_if proto tcp from any to $ext_if port 55599 #ssh
  ##out
pass out quick on $ext_if from $ext_if:network to any

Код: Выделить всё

pf_enable="YES"                 # Enable PF (load module if required)
pf_rules="/etc/pf.conf"        # rules definition file for pf
pf_flags=""                    # additional flags for pfctl startup
pflog_enable="YES"             # start pflogd(8)
pflog_logfile="/var/log/pflog" # where pflogd should store the logfile
pflog_flags=""                 # additional flags for pflogd startup
mpd_enable="YES"

Код: Выделить всё

keymap="ru.koi8-r"
scrnmap="koi8-r2cp866"
font8x16="cp866-8x16"
font8x14="cp866-8x14"
font8x8="cp866-8x8"

hostname="free.local"

# Lan Ext
ifconfig_dc0="inet 192.168.3.55  netmask 255.255.252.0"

#GATEWAY
gateway_enable="YES"

#SSHD
sshd_enable="YES"

#MPD
mpd_enable="YES"

#FSCK
fsck_y_enable="YES"

#MYSQL
mysql_enable="YES"

#PROFTPD
proftpd_enable="YES"

#PF
pf_enable="YES"                 # Enable PF (load module if required)
pf_rules="/etc/pf.conf"         # rules definition file for pf
pf_flags=""                     # additional flags for pfctl startup
pflog_enable="YES"              # start pflogd(8)
pflog_logfile="/var/log/pflog"  # where pflogd should store the logfile
pflog_flags=""                  # additional flags for pflogd startup

#POWERD
powerd_enable="YES"

#SENDMAIL
sendmail_enable="NO"
sendmail_submit_enable="NO"
sendmail_outbound_enable="NO"
sendmail_msp_queue_enable="NO"

# NTP
ntpd_enable="YES"                # Run ntpd Network Time Protocol (or NO).
ntpd_sync_on_start="YES"         # Sync time on ntpd startup, even if offset is

#firewall_enable="YES"            # Set to YES to enable firewall functionality
#firewall_script="/etc/rc.firewall" # Which script to run to set up the firewall
#firewall_type="OPEN"         # Firewall type (see /etc/rc.firewall)

Код: Выделить всё

 
ext_adrr="123.123.123.123/32"
$ext_adrr