1*6de4d5d5SDarren Reed# $FreeBSD$ 2*6de4d5d5SDarren Reed#-------------------------------------------------------------------------- 3*6de4d5d5SDarren Reed# ed1 - external interface 4*6de4d5d5SDarren Reed# fxp0 - internal interface 5*6de4d5d5SDarren Reed#-------------------------------------------------------------------------- 6*6de4d5d5SDarren Reed# First, nasty packets which we don't want near us at all 7*6de4d5d5SDarren Reed# packets which are too short to be real except echo replies on lo0 8*6de4d5d5SDarren Reedpass in log quick on lo0 proto icmp from 127.0.0.1/8 to 127.0.0.1/8 with short 9*6de4d5d5SDarren Reedblock in log quick all with short 10*6de4d5d5SDarren Reedblock in log quick all with opt lsrr 11*6de4d5d5SDarren Reedblock in log quick all with opt ssrr 12*6de4d5d5SDarren Reed#-------------------------------------------------------------------------- 13*6de4d5d5SDarren Reed# loopback packets left unmolested 14*6de4d5d5SDarren Reedpass in log quick on lo0 all 15*6de4d5d5SDarren Reedpass out log quick on lo0 all 16*6de4d5d5SDarren Reed#-------------------------------------------------------------------------- 17*6de4d5d5SDarren Reed# Group setup: 18*6de4d5d5SDarren Reed# 100 incoming ed1 19*6de4d5d5SDarren Reed# 150 outgoing ed1 20*6de4d5d5SDarren Reed# 200 incoming fxp0 21*6de4d5d5SDarren Reed# 250 outgoing fxp0 22*6de4d5d5SDarren Reed#-------------------------------------------------------------------------- 23*6de4d5d5SDarren Reedblock in log body on ed1 all head 100 24*6de4d5d5SDarren Reedblock out log body on ed1 all head 150 25*6de4d5d5SDarren Reed#-------------------------------------------------------------------------- 26*6de4d5d5SDarren Reedblock in log on fxp0 all head 200 27*6de4d5d5SDarren Reedblock out log on fxp0 all head 250 28*6de4d5d5SDarren Reed#-------------------------------------------------------------------------- 29*6de4d5d5SDarren Reed# incoming ed1 traffic - group 100 30*6de4d5d5SDarren Reed# 1) prevent localhost spoofing 31*6de4d5d5SDarren Reedblock in log quick from 127.0.0.1/32 to 192.168.0.0/24 group 100 32*6de4d5d5SDarren Reedblock in log quick from 127.0.0.1/32 to 192.168.1.0/24 group 100 33*6de4d5d5SDarren Reedblock in log quick from any to 127.0.0.1/8 group 100 34*6de4d5d5SDarren Reed#-------------------------------------------------------------------------- 35*6de4d5d5SDarren Reed# 2) deny pakets which should not be seen on th internet (paranoid) 36*6de4d5d5SDarren Reedblock in log quick from 10.0.0.0/8 to any group 100 37*6de4d5d5SDarren Reedblock in log quick from any to 10.0.0.0/8 group 100 38*6de4d5d5SDarren Reedblock in log quick from 172.16.0.0/16 to any group 100 39*6de4d5d5SDarren Reedblock in log quick from any to 172.16.0.0/16 group 100 40*6de4d5d5SDarren Reedblock in log quick from 192.168.0.0/16 to any group 100 41*6de4d5d5SDarren Reedblock in log from any to 192.168.0.0/16 group 100 42*6de4d5d5SDarren Reed# 3) implement policy 43*6de4d5d5SDarren Reed# allow incoming ftp-data 44*6de4d5d5SDarren Reedpass in log quick proto tcp/udp from any to 192.168.1.1/24 keep state group 100 45*6de4d5d5SDarren Reed# if nothing applies, block and return icmp-replies (unreachable and rst) 46*6de4d5d5SDarren Reedblock return-icmp(net-unr) in proto udp from any to any group 100 47*6de4d5d5SDarren Reedblock return-rst in log proto tcp from any to any group 100 48*6de4d5d5SDarren Reed#-------------------------------------------------------------------------- 49*6de4d5d5SDarren Reed# outgoing ed1 traffic - group 150 50*6de4d5d5SDarren Reed# Setup outgoing DNS 51*6de4d5d5SDarren Reedpass out log quick proto tcp/udp from any to 212.40.0.10 port = 53 keep state group 150 52*6de4d5d5SDarren Reedpass out log quick proto tcp/udp from any to 212.40.5.50 port = 53 keep state group 150 53*6de4d5d5SDarren Reed# allow outgoing http-service 54*6de4d5d5SDarren Reedpass out log quick proto tcp from any to any port = 80 flags S/SA keep state keep frags group 150 55*6de4d5d5SDarren Reed# allow outgoing smtp traffic 56*6de4d5d5SDarren Reedpass out log quick proto tcp from 192.168.1.1/24 to any port = 25 flags S/SA keep state group 150 57*6de4d5d5SDarren Reed# allow outgoing pop3 traffic 58*6de4d5d5SDarren Reedpass out log quick proto tcp from 192.168.1.1/24 to any port = 110 flags S/SA keep state group 150 59*6de4d5d5SDarren Reed# allow outgoing ftp traffic 60*6de4d5d5SDarren Reedpass out log quick proto tcp/udp from 192.168.1.1/24 to any port = ftp keep state group 150 61*6de4d5d5SDarren Reedpass out log quick proto icmp from any to any keep state keep frags group 150 62*6de4d5d5SDarren Reed#-------------------------------------------------------------------------- 63*6de4d5d5SDarren Reed# incoming traffic on fxp0 - group 200 64*6de4d5d5SDarren Reed#-------------------------------------------------------------------------- 65*6de4d5d5SDarren Reed# 1) prevent localhost spoofing 66*6de4d5d5SDarren Reedblock in log quick from 127.0.0.0/8 to any group 200 67*6de4d5d5SDarren Reedblock in log quick from 192.168.0.1/32 to any group 200 68*6de4d5d5SDarren Reedblock in log quick from 192.168.1.110/24 to any group 200 69*6de4d5d5SDarren Reedpass in log quick from any to any group 200 70*6de4d5d5SDarren Reed#-------------------------------------------------------------------------- 71*6de4d5d5SDarren Reed# outgoing traffic on fxp0 - group 250 72*6de4d5d5SDarren Reed#-------------------------------------------------------------------------- 73*6de4d5d5SDarren Reedblock out log quick from 127.0.0.0/8 to any group 250 74*6de4d5d5SDarren Reedblock out quick from any to 127.0.0.0/8 group 250 75*6de4d5d5SDarren Reedblock out log quick from any to 192.168.0.1/32 group 250 76*6de4d5d5SDarren Reedpass out log quick from any to nay group 250 77*6de4d5d5SDarren Reed#-------------------------------------------------------------------------- 78