145 lines
3.5 KiB
Plaintext
145 lines
3.5 KiB
Plaintext
# $NetBSD: l2tp_gw-npf.conf,v 1.6 2016/02/06 20:19:28 riastradh Exp $
|
|
#
|
|
# ex0 - (internal) network interface
|
|
# 192.0.2.254/24
|
|
# hme0 - (external) connection to Peer
|
|
# 198.51.100.142/24
|
|
|
|
$int_if = "ex0"
|
|
$ext_if = "hme0"
|
|
|
|
$private_addr = { 10.0.0.0/8, 172.16.0.0/14, 192.168.0.0/16 }
|
|
|
|
alg "icmp"
|
|
|
|
#
|
|
# NAT for all.
|
|
#
|
|
map $ext_if dynamic 192.0.2.0/24 -> inet4($ext_if)
|
|
|
|
#table <1> type tree file "/etc/npf_problem_sites"
|
|
|
|
procedure "log" {
|
|
log: npflog0
|
|
}
|
|
|
|
group "external" on $ext_if {
|
|
#
|
|
# Allow DHCP requests (even to reserved addresses).
|
|
#
|
|
pass out final proto udp from any port bootpc to any port bootps
|
|
pass in final proto udp from any port bootps to any port bootpc
|
|
pass in final proto udp from any port bootps to 255.255.255.255 port bootpc
|
|
#
|
|
# Allow DNS queries
|
|
#
|
|
pass stateful out final proto udp to any port domain
|
|
|
|
# Problem sites.
|
|
#block in final from <1> apply "log"
|
|
|
|
#
|
|
# Block IANA-reserved addresses from entering or exiting
|
|
#
|
|
block in final from $private_addr apply "log"
|
|
block out final to $private_addr apply "log"
|
|
#
|
|
pass stateful out final proto tcp all
|
|
pass stateful out final proto udp all
|
|
pass stateful out final proto icmp all
|
|
pass stateful out final proto ipv6-icmp all
|
|
|
|
block in final proto tcp to 192.0.2.255 apply "log"
|
|
|
|
#
|
|
# Prevent IP spoofing attacks on the firewall.
|
|
#
|
|
block in final from 127.0.0.1 apply "log"
|
|
|
|
#
|
|
# L2TP/IPSEC-NAT-T Tunnels.
|
|
#
|
|
pass in final proto esp from any to inet4($ext_if)
|
|
pass out final proto esp from inet4($ext_if) to any
|
|
pass stateful in final from any to inet4($ext_if) port "ipsec-nat-t"
|
|
pass stateful in final from any to inet4($ext_if) port l2tp
|
|
|
|
#
|
|
# Pass multicast.
|
|
# IGMP uses 224.0.0.1.
|
|
#
|
|
pass in final proto igmp all
|
|
pass in final from any to 224.0.0.0/4
|
|
|
|
#
|
|
# Pass established connections.
|
|
#
|
|
pass in final proto tcp flags A/A all
|
|
pass in final proto tcp flags R/R all
|
|
#
|
|
# VNC
|
|
#
|
|
pass in final proto tcp from any to any port 5500
|
|
|
|
#
|
|
# Web servers
|
|
#
|
|
#pass in final proto tcp from any to <A>/<M> port http
|
|
|
|
#
|
|
# Services on localhost.
|
|
#
|
|
#pass in final proto udp from any port ntp
|
|
#pass in final to any port imap
|
|
#pass in final to any port domain
|
|
#pass in final proto tcp to any port smtp
|
|
#pass in final proto tcp to any port auth
|
|
#pass in final proto tcp to any port ssh
|
|
#pass in final proto tcp to any port bgp
|
|
#pass in final proto tcp to any port ftp
|
|
#pass in final proto tcp to any port "ftp-data"
|
|
#pass in final proto udp to any port isakmp
|
|
#pass in final proto udp to any port 8001
|
|
#pass in final proto tcp to inet4($ext_if) port www
|
|
|
|
#
|
|
# Handle traceroute gracefully for up-to 30 hops away.
|
|
# FIXME: port-unr for ICMP is not yet supported.
|
|
#
|
|
block return-icmp in final proto udp to any port 33433-33524 apply "log"
|
|
|
|
#
|
|
# Only allow selected ICMP types.
|
|
#
|
|
pass in final proto icmp icmp-type echo all
|
|
pass in final proto icmp icmp-type timxceed all
|
|
pass in final proto icmp icmp-type unreach all
|
|
pass in final proto icmp icmp-type echoreply all
|
|
pass in final proto icmp icmp-type sourcequench all
|
|
pass in final proto icmp icmp-type paramprob all
|
|
pass in final proto ipv6-icmp all
|
|
|
|
#
|
|
# Send back a reset for new connections on tcp.
|
|
#
|
|
block return-rst in final proto tcp flags S/SA all apply "log"
|
|
}
|
|
|
|
group "internal" on $int_if {
|
|
# Pass everything to internal networks,
|
|
# should be ok, because we are nat'ed.
|
|
pass final all
|
|
}
|
|
|
|
group default {
|
|
# Loopback interface should allows packets to traverse it.
|
|
pass final on lo0 all
|
|
# For one L2TP tunnel, needs interface pre-created, post-destroyed
|
|
pass final on ppp0 all
|
|
|
|
#
|
|
# Block everything by default.
|
|
#
|
|
block final all apply "log"
|
|
}
|