Bring in some examples (and create space for future work here):
- Add OpenBSD example rulesets as advertised in etc/pf.conf and pf.conf(5) - Tweak the pointer to fit the FreeBSD default location share/examples/pf - Account for the new directory in BSD.usr.dist (no hier(7) change required as share/examples is an opaque item there). Obtained from: OpenBSD Reminded by: Thomas T. Veldhouse PR: docs/71691 MFC after: 2 days
This commit is contained in:
parent
27bc4862bd
commit
9d7ccc0ffa
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=135184
@ -1,3 +1,4 @@
|
||||
.\" $FreeBSD$
|
||||
.\" $OpenBSD: pf.conf.5,v 1.292 2004/02/24 05:44:48 mcbride Exp $
|
||||
.\"
|
||||
.\" Copyright (c) 2002, Daniel Hartmeier
|
||||
@ -27,7 +28,7 @@
|
||||
.\" ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
||||
.\" POSSIBILITY OF SUCH DAMAGE.
|
||||
.\"
|
||||
.Dd November 19, 2002
|
||||
.Dd September 14, 2004
|
||||
.Dt PF.CONF 5
|
||||
.Os
|
||||
.Sh NAME
|
||||
@ -2595,7 +2596,7 @@ sc-spec = ( bandwidth-spec |
|
||||
"(" bandwidth-spec number bandwidth-spec ")" )
|
||||
.Ed
|
||||
.Sh FILES
|
||||
.Bl -tag -width "/etc/protocols" -compact
|
||||
.Bl -tag -width "/usr/share/examples/pf" -compact
|
||||
.It Pa /etc/hosts
|
||||
Host name database.
|
||||
.It Pa /etc/pf.conf
|
||||
@ -2606,7 +2607,7 @@ Default location of OS fingerprints.
|
||||
Protocol name database.
|
||||
.It Pa /etc/services
|
||||
Service name database.
|
||||
.It Pa /usr/share/pf
|
||||
.It Pa /usr/share/examples/pf
|
||||
Example rulesets.
|
||||
.El
|
||||
.Sh SEE ALSO
|
||||
|
@ -245,6 +245,8 @@
|
||||
..
|
||||
perfmon
|
||||
..
|
||||
pf
|
||||
..
|
||||
portal
|
||||
..
|
||||
ppi
|
||||
|
@ -1,7 +1,7 @@
|
||||
# $FreeBSD$
|
||||
# $OpenBSD: pf.conf,v 1.21 2003/09/02 20:38:44 david Exp $
|
||||
#
|
||||
# See pf.conf(5) and /usr/share/pf for syntax and examples.
|
||||
# See pf.conf(5) and /usr/share/examples/pf for syntax and examples.
|
||||
# Required order: options, normalization, queueing, translation, filtering.
|
||||
# Macros and tables may be defined and used anywhere.
|
||||
# Note that translation rules are first match while filter rules are last match.
|
||||
|
@ -290,6 +290,9 @@ SUBDIR= smbfs
|
||||
.if !defined(NO_IPFILTER)
|
||||
SUBDIR+=ipfilter
|
||||
.endif
|
||||
.if !defined(NO_PF)
|
||||
SUBDIR+=pf
|
||||
.endif
|
||||
.endif
|
||||
|
||||
.include <bsd.subdir.mk>
|
||||
|
11
share/examples/pf/Makefile
Normal file
11
share/examples/pf/Makefile
Normal file
@ -0,0 +1,11 @@
|
||||
# $FreeBSD$
|
||||
|
||||
NOOBJ= noobj
|
||||
|
||||
FILES= faq-example1 faq-example2 faq-example3 \
|
||||
ackpri queue1 queue2 queue3 queue4 \
|
||||
spamd
|
||||
|
||||
FILESDIR= ${SHAREDIR}/examples/pf
|
||||
|
||||
.include <bsd.prog.mk>
|
33
share/examples/pf/ackpri
Normal file
33
share/examples/pf/ackpri
Normal file
@ -0,0 +1,33 @@
|
||||
# $FreeBSD$
|
||||
# $OpenBSD: ackpri,v 1.2 2003/03/10 14:24:33 henning Exp $
|
||||
|
||||
# Use a simple priority queue to prioritize empty (no payload) TCP ACKs,
|
||||
# which dramatically improves throughput on (asymmetric) links when the
|
||||
# reverse direction is saturated. The empty ACKs use an insignificant
|
||||
# part of the bandwidth, but if they get delayed, downloads suffer
|
||||
# badly, so prioritize them.
|
||||
|
||||
# Example: 512/128 kbps ADSL. Download is 50 kB/s. When a concurrent
|
||||
# upload saturates the uplink, download drops to 7 kB/s. With the
|
||||
# priority queue below, download drops only to 48 kB/s.
|
||||
|
||||
# Replace lo0 with your real external interface
|
||||
|
||||
ext_if="lo0"
|
||||
|
||||
# For a 512/128 kbps ADSL with PPPoE link, using "bandwidth 100Kb"
|
||||
# is optimal. Some experimentation might be needed to find the best
|
||||
# value. If it's set too high, the priority queue is not effective, and
|
||||
# if it's set too low, the available bandwidth is not fully used.
|
||||
# A good starting point would be real_uplink_bandwidth * 90 / 100.
|
||||
|
||||
altq on $ext_if priq bandwidth 100Kb queue { q_pri, q_def }
|
||||
queue q_pri priority 7
|
||||
queue q_def priority 1 priq(default)
|
||||
|
||||
pass out on $ext_if proto tcp from $ext_if to any flags S/SA \
|
||||
keep state queue (q_def, q_pri)
|
||||
|
||||
pass in on $ext_if proto tcp from any to $ext_if flags S/SA \
|
||||
keep state queue (q_def, q_pri)
|
||||
|
48
share/examples/pf/faq-example1
Normal file
48
share/examples/pf/faq-example1
Normal file
@ -0,0 +1,48 @@
|
||||
# $FreeBSD$
|
||||
# $OpenBSD: faq-example1,v 1.2 2003/08/06 16:04:45 henning Exp $
|
||||
|
||||
#
|
||||
# Firewall for Home or Small Office
|
||||
# http://www.openbsd.org/faq/pf/example1.html
|
||||
#
|
||||
|
||||
|
||||
# macros
|
||||
int_if = "fxp0"
|
||||
ext_if = "ep0"
|
||||
|
||||
tcp_services = "{ 22, 113 }"
|
||||
icmp_types = "echoreq"
|
||||
|
||||
priv_nets = "{ 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8 }"
|
||||
|
||||
# options
|
||||
set block-policy return
|
||||
set loginterface $ext_if
|
||||
|
||||
# scrub
|
||||
scrub in all
|
||||
|
||||
# nat/rdr
|
||||
nat on $ext_if from $int_if:network to any -> ($ext_if)
|
||||
rdr on $int_if proto tcp from any to any port 21 -> 127.0.0.1 \
|
||||
port 8021
|
||||
|
||||
# filter rules
|
||||
block all
|
||||
|
||||
pass quick on lo0 all
|
||||
|
||||
block drop in quick on $ext_if from $priv_nets to any
|
||||
block drop out quick on $ext_if from any to $priv_nets
|
||||
|
||||
pass in on $ext_if inet proto tcp from any to ($ext_if) \
|
||||
port $tcp_services flags S/SA keep state
|
||||
|
||||
pass in inet proto icmp all icmp-type $icmp_types keep state
|
||||
|
||||
pass in on $int_if from $int_if:network to any keep state
|
||||
pass out on $int_if from any to $int_if:network keep state
|
||||
|
||||
pass out on $ext_if proto tcp all modulate state flags S/SA
|
||||
pass out on $ext_if proto { udp, icmp } all keep state
|
89
share/examples/pf/faq-example2
Normal file
89
share/examples/pf/faq-example2
Normal file
@ -0,0 +1,89 @@
|
||||
# $FreeBSD$
|
||||
# $OpenBSD: faq-example2,v 1.2 2003/08/06 16:04:45 henning Exp $
|
||||
|
||||
#
|
||||
# Small, Home Network
|
||||
# http://www.openbsd.org/faq/pf/queueing.html#example1
|
||||
#
|
||||
|
||||
|
||||
# enable queueing on the external interface to control traffic going to
|
||||
# the Internet. use the priq scheduler to control only priorities. set
|
||||
# the bandwidth to 610Kbps to get the best performance out of the TCP
|
||||
# ACK queue.
|
||||
|
||||
altq on fxp0 priq bandwidth 610Kb queue { std_out, ssh_im_out, dns_out, \
|
||||
tcp_ack_out }
|
||||
|
||||
# define the parameters for the child queues.
|
||||
# std_out - the standard queue. any filter rule below that does not
|
||||
# explicitly specify a queue will have its traffic added
|
||||
# to this queue.
|
||||
# ssh_im_out - interactive SSH and various instant message traffic.
|
||||
# dns_out - DNS queries.
|
||||
# tcp_ack_out - TCP ACK packets with no data payload.
|
||||
|
||||
queue std_out priq(default)
|
||||
queue ssh_im_out priority 4 priq(red)
|
||||
queue dns_out priority 5
|
||||
queue tcp_ack_out priority 6
|
||||
|
||||
# enable queueing on the internal interface to control traffic coming in
|
||||
# from the Internet. use the cbq scheduler to control bandwidth. max
|
||||
# bandwidth is 2Mbps.
|
||||
|
||||
altq on dc0 cbq bandwidth 2Mb queue { std_in, ssh_im_in, dns_in, bob_in }
|
||||
|
||||
# define the parameters for the child queues.
|
||||
# std_in - the standard queue. any filter rule below that does not
|
||||
# explicitly specify a queue will have its traffic added
|
||||
# to this queue.
|
||||
# ssh_im_in - interactive SSH and various instant message traffic.
|
||||
# dns_in - DNS replies.
|
||||
# bob_in - bandwidth reserved for Bob's workstation. allow him to
|
||||
# borrow.
|
||||
|
||||
queue std_in cbq(default)
|
||||
queue ssh_im_in priority 4
|
||||
queue dns_in priority 5
|
||||
queue bob_in bandwidth 80Kb cbq(borrow)
|
||||
|
||||
|
||||
# ... in the filtering section of pf.conf ...
|
||||
|
||||
alice = "192.168.0.2"
|
||||
bob = "192.168.0.3"
|
||||
charlie = "192.168.0.4"
|
||||
local_net = "192.168.0.0/24"
|
||||
ssh_ports = "{ 22 2022 }"
|
||||
im_ports = "{ 1863 5190 5222 }"
|
||||
|
||||
# filter rules for fxp0 inbound
|
||||
block in on fxp0 all
|
||||
|
||||
# filter rules for fxp0 outbound
|
||||
block out on fxp0 all
|
||||
pass out on fxp0 inet proto tcp from (fxp0) to any flags S/SA \
|
||||
keep state queue(std_out, tcp_ack_out)
|
||||
pass out on fxp0 inet proto { udp icmp } from (fxp0) to any keep state
|
||||
pass out on fxp0 inet proto { tcp udp } from (fxp0) to any port domain \
|
||||
keep state queue dns_out
|
||||
pass out on fxp0 inet proto tcp from (fxp0) to any port $ssh_ports \
|
||||
flags S/SA keep state queue(std_out, ssh_im_out)
|
||||
pass out on fxp0 inet proto tcp from (fxp0) to any port $im_ports \
|
||||
flags S/SA keep state queue(ssh_im_out, tcp_ack_out)
|
||||
|
||||
# filter rules for dc0 inbound
|
||||
block in on dc0 all
|
||||
pass in on dc0 from $local_net
|
||||
|
||||
# filter rules for dc0 outbound
|
||||
block out on dc0 all
|
||||
pass out on dc0 from any to $local_net
|
||||
pass out on dc0 proto { tcp udp } from any port domain to $local_net \
|
||||
queue dns_in
|
||||
pass out on dc0 proto tcp from any port $ssh_ports to $local_net \
|
||||
queue(std_in, ssh_im_in)
|
||||
pass out on dc0 proto tcp from any port $im_ports to $local_net \
|
||||
queue ssh_im_in
|
||||
pass out on dc0 from any to $bob queue bob_in
|
119
share/examples/pf/faq-example3
Normal file
119
share/examples/pf/faq-example3
Normal file
@ -0,0 +1,119 @@
|
||||
# $FreeBSD$
|
||||
# $OpenBSD: faq-example3,v 1.2 2003/08/06 16:04:45 henning Exp $
|
||||
|
||||
#
|
||||
# Company Network
|
||||
# http://www.openbsd.org/faq/pf/queueing.html#example2
|
||||
#
|
||||
|
||||
|
||||
# enable queueing on the external interface to queue packets going out
|
||||
# to the Internet. use the cbq scheduler so that the bandwidth use of
|
||||
# each queue can be controlled. the max outgoing bandwidth is 1.5Mbps.
|
||||
|
||||
altq on fxp0 cbq bandwidth 1.5Mb queue { std_ext, www_ext, boss_ext }
|
||||
|
||||
# define the parameters for the child queues.
|
||||
# std_ext - the standard queue. also the default queue for
|
||||
# outgoing traffic on fxp0.
|
||||
# www_ext - container queue for WWW server queues. limit to
|
||||
# 500Kbps.
|
||||
# www_ext_http - http traffic from the WWW server
|
||||
# www_ext_misc - all non-http traffic from the WWW server
|
||||
# boss_ext - traffic coming from the boss's computer
|
||||
|
||||
queue std_ext cbq(default)
|
||||
queue www_ext bandwidth 500Kb { www_ext_http, www_ext_misc }
|
||||
queue www_ext_http priority 3 cbq(red)
|
||||
queue www_ext_misc priority 1
|
||||
queue boss_ext priority 3
|
||||
|
||||
# enable queueing on the internal interface to control traffic coming
|
||||
# from the Internet or the DMZ. use the cbq scheduler to control the
|
||||
# bandwidth of each queue. bandwidth on this interface is set to the
|
||||
# maximum. traffic coming from the DMZ will be able to use all of this
|
||||
# bandwidth while traffic coming from the Internet will be limited to
|
||||
# 1.0Mbps (because 0.5Mbps (500Kbps) is being allocated to fxp1).
|
||||
|
||||
altq on dc0 cbq bandwidth 100% queue { net_int, www_int }
|
||||
|
||||
# define the parameters for the child queues.
|
||||
# net_int - container queue for traffic from the Internet. bandwidth
|
||||
# is 1.0Mbps.
|
||||
# std_int - the standard queue. also the default queue for outgoing
|
||||
# traffic on dc0.
|
||||
# it_int - traffic to the IT Dept network.
|
||||
# boss_int - traffic to the boss's PC.
|
||||
# www_int - traffic from the WWW server in the DMZ.
|
||||
|
||||
queue net_int bandwidth 1.0Mb { std_int, it_int, boss_int }
|
||||
queue std_int cbq(default)
|
||||
queue it_int bandwidth 500Kb cbq(borrow)
|
||||
queue boss_int priority 3
|
||||
queue www_int cbq(red)
|
||||
|
||||
# enable queueing on the DMZ interface to control traffic destined for
|
||||
# the WWW server. cbq will be used on this interface since detailed
|
||||
# control of bandwidth is necessary. bandwidth on this interface is set
|
||||
# to the maximum. traffic from the internal network will be able to use
|
||||
# all of this bandwidth while traffic from the Internet will be limited
|
||||
# to 500Kbps.
|
||||
|
||||
altq on fxp1 cbq bandwidth 100% queue { internal_dmz, net_dmz }
|
||||
|
||||
# define the parameters for the child queues.
|
||||
# internal_dmz - traffic from the internal network.
|
||||
# net_dmz - container queue for traffic from the Internet.
|
||||
# net_dmz_http - http traffic.
|
||||
# net_dmz_misc - all non-http traffic. this is also the default queue.
|
||||
|
||||
queue internal_dmz # no special settings needed
|
||||
queue net_dmz bandwidth 500Kb { net_dmz_http, net_dmz_misc }
|
||||
queue net_dmz_http priority 3 cbq(red)
|
||||
queue net_dmz_misc priority 1 cbq(default)
|
||||
|
||||
|
||||
# ... in the filtering section of pf.conf ...
|
||||
|
||||
main_net = "192.168.0.0/24"
|
||||
it_net = "192.168.1.0/24"
|
||||
int_nets = "{ 192.168.0.0/24, 192.168.1.0/24 }"
|
||||
dmz_net = "10.0.0.0/24"
|
||||
|
||||
boss = "192.168.0.200"
|
||||
wwwserv = "10.0.0.100"
|
||||
|
||||
# default deny
|
||||
block on { fxp0, fxp1, dc0 } all
|
||||
|
||||
# filter rules for fxp0 inbound
|
||||
pass in on fxp0 proto tcp from any to $wwwserv port { 21, \
|
||||
> 49151 } flags S/SA keep state queue www_ext_misc
|
||||
pass in on fxp0 proto tcp from any to $wwwserv port 80 \
|
||||
flags S/SA keep state queue www_ext_http
|
||||
|
||||
# filter rules for fxp0 outbound
|
||||
pass out on fxp0 from $int_nets to any keep state
|
||||
pass out on fxp0 from $boss to any keep state queue boss_ext
|
||||
|
||||
# filter rules for dc0 inbound
|
||||
pass in on dc0 from $int_nets to any keep state
|
||||
pass in on dc0 from $it_net to any queue it_int
|
||||
pass in on dc0 from $boss to any queue boss_int
|
||||
pass in on dc0 proto tcp from $int_nets to $wwwserv port { 21, 80, \
|
||||
> 49151 } flags S/SA keep state queue www_int
|
||||
|
||||
# filter rules for dc0 outbound
|
||||
pass out on dc0 from dc0 to $int_nets
|
||||
|
||||
# filter rules for fxp1 inbound
|
||||
pass in on fxp1 proto { tcp, udp } from $wwwserv to any port 53 \
|
||||
keep state
|
||||
|
||||
# filter rules for fxp1 outbound
|
||||
pass out on fxp1 proto tcp from any to $wwwserv port { 21, \
|
||||
> 49151 } flags S/SA keep state queue net_dmz_misc
|
||||
pass out on fxp1 proto tcp from any to $wwwserv port 80 \
|
||||
flags S/SA keep state queue net_dmz_http
|
||||
pass out on fxp1 proto tcp from $int_nets to $wwwserv port { 80, \
|
||||
21, > 49151 } flags S/SA keep state queue internal_dmz
|
23
share/examples/pf/queue1
Normal file
23
share/examples/pf/queue1
Normal file
@ -0,0 +1,23 @@
|
||||
# $FreeBSD$
|
||||
# $OpenBSD: queue1,v 1.3 2003/01/20 16:14:23 henning Exp $
|
||||
|
||||
ext_if = "dc0"
|
||||
|
||||
altq on $ext_if cbq bandwidth 10Mb \
|
||||
queue { deflt, http, ssh, mail, rsets }
|
||||
queue deflt bandwidth 10% priority 0 cbq(default ecn)
|
||||
queue http bandwidth 1.5Mb priority 3 { http_vhosts, http_cust1 }
|
||||
queue http_vhosts bandwidth 40% cbq(borrow red)
|
||||
queue http_cust1 bandwidth 0.5Mb
|
||||
queue mail bandwidth 10% priority 1
|
||||
queue ssh bandwidth 100Kb priority 7 cbq(borrow)
|
||||
queue rsets bandwidth 7500b priority 0 cbq(red)
|
||||
|
||||
block return in on $ext_if inet all queue rsets
|
||||
pass in on $ext_if inet proto tcp from any to any port 80 keep state queue http
|
||||
pass out on $ext_if inet proto tcp from any to any port 22 keep state queue ssh
|
||||
pass in on $ext_if inet proto tcp from any to any port 22 keep state queue ssh
|
||||
pass out on $ext_if inet proto tcp from any to any port 25 keep state queue mail
|
||||
pass out on $ext_if inet all keep state
|
||||
|
||||
|
29
share/examples/pf/queue2
Normal file
29
share/examples/pf/queue2
Normal file
@ -0,0 +1,29 @@
|
||||
# $FreeBSD$
|
||||
# $OpenBSD: queue2,v 1.2 2003/01/20 16:14:23 henning Exp $
|
||||
# advanced queue example.
|
||||
# give interactive ssh traffic priority over ssh bulk transfers (scp, sftp)
|
||||
|
||||
ext_if="dc0"
|
||||
developerhosts="192.168.2.0/24"
|
||||
employeehosts="192.168.0.0/23"
|
||||
|
||||
altq on $ext_if cbq bandwidth 5Mb queue { std, http, mail, ssh }
|
||||
|
||||
queue std bandwidth 10% cbq(default)
|
||||
queue http bandwidth 60% priority 2 cbq(borrow red) { employees, developers }
|
||||
queue developers bandwidth 75% cbq(borrow)
|
||||
queue employees bandwidth 15%
|
||||
queue mail bandwidth 10% priority 0 cbq(borrow ecn)
|
||||
queue ssh bandwidth 20% cbq(borrow) { ssh_interactive, ssh_bulk }
|
||||
queue ssh_interactive priority 7
|
||||
queue ssh_bulk priority 0
|
||||
|
||||
block return out on $ext_if inet all queue std
|
||||
pass out on $ext_if inet proto tcp from $developerhosts to any port 80 \
|
||||
keep state queue developers
|
||||
pass out on $ext_if inet proto tcp from $employeehosts to any port 80 \
|
||||
keep state queue employees
|
||||
pass out on $ext_if inet proto tcp from any to any port 22 \
|
||||
keep state queue(ssh_bulk, ssh_interactive)
|
||||
pass out on $ext_if inet proto tcp from any to any port 25 \
|
||||
keep state queue mail
|
16
share/examples/pf/queue3
Normal file
16
share/examples/pf/queue3
Normal file
@ -0,0 +1,16 @@
|
||||
# $FreeBSD$
|
||||
# $OpenBSD: queue3,v 1.2 2003/01/20 16:14:23 henning Exp $
|
||||
# simple PRIQ example
|
||||
|
||||
ext_if="lo0"
|
||||
|
||||
altq on $ext_if priq bandwidth 10Mb queue { pri-low pri-med pri-high }
|
||||
queue pri-low priority 0
|
||||
queue pri-med priority 1 priq(default)
|
||||
queue pri-high priority 2
|
||||
|
||||
pass out on $ext_if proto tcp from any to any port 22 keep state \
|
||||
queue(pri-med, pri-high)
|
||||
pass out on $ext_if proto tcp from any to any port 80 keep state queue pri-med
|
||||
pass in on $ext_if proto tcp from any to any port 80 keep state queue pri-low
|
||||
|
20
share/examples/pf/queue4
Normal file
20
share/examples/pf/queue4
Normal file
@ -0,0 +1,20 @@
|
||||
# $FreeBSD$
|
||||
# $OpenBSD: queue4,v 1.2 2003/08/22 21:50:34 david Exp $
|
||||
#
|
||||
# Hierarchical queueing for a university.
|
||||
# Three faculties; engineering, law and art are defined.
|
||||
# Departments under the engineering faculty are defined as child queues.
|
||||
# The total bandwidth for engineering faculty is shared between three
|
||||
# departments. CS department gets the half of the bandwidth, EE and IE
|
||||
# departments get the thirty percent and twenty percent of bandwidth
|
||||
# respectively. These sibling departments can use more than their linkshare
|
||||
# whenever there is no backlogged sibling queue but when a queue gets
|
||||
# backlogged, it is guaranteed that the queue gets its linkshare.
|
||||
|
||||
altq on dc0 bandwidth 16Mb hfsc queue { eng law art }
|
||||
queue eng bandwidth 10Mb { cs ee ie }
|
||||
queue cs hfsc( default linkshare 50% )
|
||||
queue ee hfsc( linkshare 30% )
|
||||
queue ie hfsc( linkshare 20% )
|
||||
queue law bandwidth 3Mb
|
||||
queue art bandwidth 3Mb
|
8
share/examples/pf/spamd
Normal file
8
share/examples/pf/spamd
Normal file
@ -0,0 +1,8 @@
|
||||
# $FreeBSD$
|
||||
# $OpenBSD: spamd,v 1.1 2003/08/22 15:25:01 henning Exp $
|
||||
|
||||
# spamd-setup puts addresses to be redirected into table <spamd>.
|
||||
|
||||
table <spamd> persist
|
||||
no rdr on { lo0, lo1 } from any to any
|
||||
rdr inet proto tcp from <spamd> to any port smtp -> 127.0.0.1 port 8025
|
Loading…
Reference in New Issue
Block a user