2024-08-26 04:01:59 +02:00
|
|
|
|
|
|
|
|
#define interfaces
|
2019-03-26 05:57:16 +01:00
|
|
|
#ext_if="em0"
|
2024-08-26 04:01:59 +02:00
|
|
|
|
|
|
|
|
#normalize packets
|
2017-04-04 04:40:45 +02:00
|
|
|
scrub in all
|
|
|
|
|
|
2024-08-26 04:01:59 +02:00
|
|
|
#skip rule for loopback interface
|
|
|
|
|
set skip on lo0
|
|
|
|
|
|
|
|
|
|
#prevent spoofing for all interfaces
|
|
|
|
|
antispoof quick for all
|
|
|
|
|
|
|
|
|
|
#allow traffic on loopback
|
|
|
|
|
pass quick on lo0 all
|
|
|
|
|
|
|
|
|
|
#add the pf tables
|
2019-03-26 05:57:16 +01:00
|
|
|
table <pf-pass> persist file "/etc/pf-pass.conf"
|
2024-08-26 04:01:59 +02:00
|
|
|
table <pf-block> persist file "/etc/pf-block.conf"
|
|
|
|
|
table <sip-auth-ip> persist file "/etc/pf-block-sip-auth-ip.conf"
|
|
|
|
|
table <sip-auth-fail> persist file "/etc/pf-block-sip-auth-fail.conf"
|
2017-04-04 04:40:45 +02:00
|
|
|
|
2024-08-26 04:01:59 +02:00
|
|
|
#allow outbound traffic
|
2017-04-04 05:14:10 +02:00
|
|
|
pass out quick all
|
|
|
|
|
|
2024-08-26 04:01:59 +02:00
|
|
|
#pass allowed addresses
|
|
|
|
|
pass in quick from <pf-pass> to any keep state
|
|
|
|
|
|
|
|
|
|
#block traffic from blocked addresses
|
2019-03-26 05:57:16 +01:00
|
|
|
block in quick from <pf-block>
|
2024-08-26 04:01:59 +02:00
|
|
|
block in quick from <sip-auth-ip>
|
|
|
|
|
block in quick from <sip-auth-fail>
|
2019-03-26 05:57:16 +01:00
|
|
|
|
2024-08-26 04:01:59 +02:00
|
|
|
#allow ICMP
|
2017-04-04 05:14:10 +02:00
|
|
|
pass in quick inet proto icmp all
|
|
|
|
|
pass in quick inet6 proto icmp6 all
|
2017-04-04 04:40:45 +02:00
|
|
|
|
2024-08-26 04:01:59 +02:00
|
|
|
#allow additional ports
|
2017-04-04 04:40:45 +02:00
|
|
|
pass in quick inet proto tcp from any to any port 22 keep state
|
|
|
|
|
pass in quick inet proto tcp from any to any port 80 keep state
|
|
|
|
|
pass in quick inet proto tcp from any to any port 443 keep state
|
2018-07-26 20:26:42 +02:00
|
|
|
pass in quick inet proto tcp from any to any port 7443 keep state
|
2019-03-26 05:57:16 +01:00
|
|
|
pass in quick inet proto tcp from any to any port 5060:5091 keep state
|
|
|
|
|
pass in quick inet proto udp from any to any port 5060:5091 keep state
|
2017-04-04 04:40:45 +02:00
|
|
|
pass in quick inet proto udp from any to any port 16384:32768 keep state
|
2018-07-26 20:26:42 +02:00
|
|
|
|
2024-08-26 04:01:59 +02:00
|
|
|
#default block rule
|
|
|
|
|
block in all
|
