forum.lissyara.su

Код: Выделить всё

### Описание интерфейсов ###
int_if="lan"
ext_if="tun0"
vpn_if="tun1"

lannet="192.168.1.0/24"
int_ip="192.168.1.1"
ext_ip="1.2.3.4"
vpn_ip="10.10.100.1"
pbx="192.168.1.11"

www="{ 80,443 }"
mail="{ 465,587,993,995,143 }"
rdp="{ 730 }"
torrent="{ 51413,49152:65535,5650:5670 }"
ssh="{ 1981,1985,1986 }"
vpn="{ 1983, 1423 }"
ftp="{ 20,21,30000:65000 }"
voip="{ 4000:4010,4050:4090,5060:5065,5160:5165,8000:8002,9000:65534 }"
udp_services="{ 53,123 }"

icmp_types="{echoreq, unreach}"

### PF_tables ###
table <white_list> persist { 1.2.3.4 }

table <full_dos> persist file "/etc/pftables/full_dos"
table <ca.zone> persist file "/etc/pftables/ca.zone"
table <cn.zone> persist file "/etc/pftables/cn.zone"
table <de.zone> persist file "/etc/pftables/de.zone"
table <fr.zone> persist file "/etc/pftables/fr.zone"
table <ua.zone> persist file "/etc/pftables/ua.zone"
table <ip.bloc> persist file "/etc/pftables/ip.bloc"
#table <ddos> persist file "/etc/pftables/ddos"
#table <ssh> persist file "/etc/pftables/ssh"

### CONTROL PF ###
#set block-policy return  ## сбрасываем соединение вежливо
set timeout { frag 10, tcp.established 3600 } # Изменяем время для состояния установленного tcp соединения, которое по-умолчанию чересчур большое (24часа).
set block-policy drop  ## сбрасываем соединение грубо
set skip on lo0  ## полностью пропускаем проверку на петле
set skip on $int_if  ## полностью пропускаем проверку на интерфейсе
set skip on $vpn_if
set loginterface $ext_if
set optimization normal

scrub in all  ## нормализуем все входящие пакеты на всех интерфейсах
scrub on $ext_if all reassemble tcp

### NAT ###
#nat on $ext_if inet from $lannet to any -> ($ext_if)
nat on $ext_if inet from $int_ip to any -> ($ext_if)
nat on $ext_if inet from <full_dos> to any -> ($ext_if)
nat on $ext_if inet proto tcp from $lannet to any port $www -> ($ext_if)
nat on $ext_if inet proto tcp from $lannet to any port $mail -> ($ext_if)
nat on $ext_if inet proto udp from $lannet to any port $udp_services -> ($ext_if)
nat log on $ext_if inet proto icmp from $lannet to any -> ($ext_if)

### filters ###
antispoof log quick for { lo0, $int_if, $ext_if }

### Блочим всех кто находится в таблице ###
block in log all
block out log all
block in quick on $ext_if from <ip.bloc> to ($ext_if)
block in quick on $ext_if from <ca.zone> to ($ext_if)
block in quick on $ext_if from <cn.zone> to ($ext_if)
block in quick on $ext_if from <de.zone> to ($ext_if)
block in quick on $ext_if from <fr.zone> to ($ext_if)
block in quick on $ext_if from <ua.zone> to ($ext_if)
block in quick on $ext_if from <us.zone> to ($ext_if)
block drop in log quick on $ext_if from <ddos> to any
block drop in log quick on $ext_if from <ssh> to any

pass out quick on $ext_if from ($ext_if) to any
pass out quick on $vpn_if from ($vpn_if) to any

pass quick on lo0 all ## разрешаем петлю
pass quick on $ext_if from <white_list> to ($ext_if) keep state

# Разрешаем открытые порты на внешнем интерфейсе
pass in on $ext_if proto tcp from any to ($ext_if) port $www synproxy state  ## чистим траф www от SYN flood
pass in on $ext_if proto tcp to ($ext_if) port $www flags S/SA keep state \(max-src-conn 60, max-src-conn-rate 10/2, overload <ddos> flush) ## www режим тех кто превысил лимиты и ложим в таблицу
pass in on $ext_if proto tcp to ($ext_if) port $ssh flags S/SA keep state \(max-src-conn 5, max-src-conn-rate 10/5, overload <ssh> flush global)
pass in on $ext_if proto tcp to ($ext_if) port $rdp flags S/SA keep state \(max-src-conn 1, max-src-conn-rate 5/20, overload <ddos> flush global)
pass in on $ext_if proto tcp to ($ext_if) port $ftp flags S/SA keep state \(max-src-conn 1, max-src-conn-rate 5/20, overload <ddos> flush global)
pass in on $ext_if proto udp to ($ext_if) port $vpn keep state \(max-src-conn 1, max-src-conn-rate 5/20, overload <ddos> flush global)
pass in on $ext_if proto tcp to ($ext_if) port $mail flags S/SA keep state \(max-src-conn 50, max-src-conn-rate 8/60, overload <ddos> flush global)
pass in on $ext_if proto tcp to ($ext_if) port $torrent keep state \(max-src-conn 50, max-src-conn-rate 10/60, overload <ddos> flush global)

pass in quick on $ext_if inet proto {tcp, udp, icmp} all keep state

pass log inet proto icmp all icmp-type $icmp_types