forum.lissyara.su

Код: Выделить всё

altq on $vpn_if cbq bandwidth 500Kb queue \
 { qffice1, qoffice2 }
queue qffice1 bandwidth 70% priority 3 cbq ( default borrow )
queue qoffice2 bandwidth 30% priority 2 cbq ( borrow )

Код: Выделить всё

====#

# IF #

#====#

vpn_if="ng0"

ext_if="rl0"

int_if="nfe0"

off_if="xl0"

#=====#

# IPs #

#=====#

ext_ip="172.16.6.6"

int_ip="192.168.1.110"

vpn_srv="172.16.6.252"

off_ip="192.168.2.1"

#=====#

# NET #

#=====#

office1="192.168.1.0/24"

office2="192.168.2.0/28"

#============#

# add tables #

#============#

table <BRUTEFORCERS> persist

#=======#

# OTHER #

#=======#

allow_ports="{ 80, https, aol, ftp, ftp-data, 6667, auth, smtp, pop3, 53, 6112 }"

icmp_types="{ echoreq, unreach }"

set block-policy drop

#===================#

# normalize traffic #

#===================#

scrub in all max-mss 1496 fragment reassemble

scrub out all max-mss 1496 fragment reassemble random-id

#=======#

# SHAPE #

#=======#

altq on $vpn_if cbq bandwidth 245Kb queue \

 { qoffice1, qoffice2 }

queue qoffice1 bandwidth 70% priority 7 cbq ( borrow )

queue qoffice2 bandwidth 30% priority 2 cbq ( default borrow )

#=====#

# NAT #

#=====#

nat on $vpn_if from $office1 to any -> ($vpn_if)

nat on $vpn_if from $office2 to any port $allow_ports -> ($vpn_if)

#===============#

# Default block #

#===============#

block log all

block on $ext_if inet6 all

block in on $ext_if proto { tcp, udp } from 172.16.0.0/16 to any

block in on { $ext_if, $off_if } proto { tcp, udp } from any port { 137, 138, 139, 67 } to any

block in on { $ext_if, $off_if } proto { tcp, udp } from any to any port { 137, 138, 139, 67 }

block in log on $vpn_if inet proto icmp

#=======#

# OTHER #

#=======#

antispoof log quick for { lo0, $ext_if }

set skip on lo0

#=======#

# QUEUE #

#=======#

pass out on $vpn_if from $office1 to any queue qoffice1 modulate state

pass out on $vpn_if from $office2 to any queue qoffice2 modulate state

#==========#

# INTERNAL #

#==========#

pass in on $int_if from $office1 to $int_ip 

pass out on { $int_if, $off_if } to any

pass in on $off_if from $office2 to $off_ip

#=======#

#  SSH  #

#=======#

pass in on $vpn_if proto tcp from any to any port 23 \

    synproxy state ( max-src-conn-rate 1/60 overload <BRUTEFORCES> flush global )

#======#

# ICMP #

#======#

pass log inet proto icmp all icmp-type $icmp_types

#==========#

# EXTERNAL #

#==========#

pass quick from 10.0.1.22 to any

pass out on $vpn_if inet from any to any

#traceroute

pass out on { $ext_if, $vpn_if } inet proto udp from any to any \

		port 33433 >< 33626 keep state

#Traffic

pass in on $off_if proto { tcp, udp } from $office2 to any port $allow_ports \

	     flags S/SA keep state

pass in on $int_if from $office1 to any

Код: Выделить всё

scrub out all random-id max-mss 1496 fragment reassemble
nat on ng0 inet from 192.168.1.0/24 to any -> (ng0) round-robin
nat on ng0 inet from 192.168.2.0/28 to any port = http -> (ng0) round-robin
nat on ng0 inet from 192.168.2.0/28 to any port = https -> (ng0) round-robin
nat on ng0 inet from 192.168.2.0/28 to any port = aol -> (ng0) round-robin
nat on ng0 inet from 192.168.2.0/28 to any port = ftp -> (ng0) round-robin
nat on ng0 inet from 192.168.2.0/28 to any port = ftp-data -> (ng0) round-robin
nat on ng0 inet from 192.168.2.0/28 to any port = 6667 -> (ng0) round-robin

Код: Выделить всё

pfctl -vsr -v