PF (Packet Filtering)

1:

PF( Packet Filtering)
vim /etc/rc.conf
pf_enable="YES"
pflog_enable="YES"
:wq
vim /etc/pf.conf
#1. Macros
#2. Tables
#3. Options
#4. Packet normalization
#5. Bandwidth management
#6. Translation
#7. Redirection
#8. Packet filtering
interface="em0"
scrub in all
block in on $interface
# allow SSH and POP3 traffic from our network
pass in on $interface proto tcp from 192.168.1.0/24 to $interface port 22
pass in on $interface proto tcp from 192.168.1.0/24 to $interface port 110
# allow SMTP (25), HTTP (80), and HTTPS (443) to the world
pass in on $interface proto tcp from any to $interface port 25
pass in on $interface proto tcp from any to $interface port 80
pass in on $interface proto tcp from any to $interface port 443
# allow the world to query our DNS server
pass in on $interface proto tcp from any to $interface port 53
pass in on $interface proto udp from any to $interface port 53
# allow outgoing traffic
pass out on $interface proto { tcp, udp } all
:wq



# 检查语法 但不加载规则
# pfctl -nf /etc/pf.conf
# 加载规则
# pfctl -f /etc/pf.conf
# 查看 filter规则
# pfctl -sr		(-s rules)
# pfctl -s info
# 清空所有规则
# pfctl -Fa		(-F all)
# pf -e			(/etc/rc.d/pf start)
# pf -d			(/etc/rc.d/pf stop)
--------------------------------------------------------------------
block in all
pass out all

tcp_services = "{ ssh, smtp, domain, www, pop3, auth, https, pop3s }"
udp_services = "{ domain }"
block all
pass out proto tcp to any port $tcp_services
pass out proto udp to any port $udp_services

Gateway:
Vim /etc/rc.conf
gateway_enable="YES" 			# for ipv4
ipv6_gateway_enable="YES" 		# for ipv6

ext_if = "re0" 			# macro for external interface - use tun0 or pppoe0 for PPPoE
int_if = "re1" 			# macro for internal interface
localnet = $int_if:192.168.1.0/24

client_out = "{ ftp-data, ftp, ssh, domain, pop3, auth, nntp, http,\
https, 446, cvspserver, 2628, 5999, 8000, 8080 }"
udp_services = "{ domain, ntp }"

# ext_if IP address could be dynamic, hence ($ext_if)
nat on $ext_if from $localnet to any -> ($ext_if)
block all
pass in inet proto tcp from any to $ext_if port ssh
pass quick inet proto { tcp, udp } to any port $udp_services

# For each packet or
connection evaluated by PF, the last matching rule in the rule set is the one
that is applied. quick keyword offers an escape from the ordinary sequence
The rule processing stops without considering any further rules that
might have matched the packet.

pass from { lo0, $localnet } to any keep state

2:

3:

4:

5:

6: