Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- ########################
- # part of /etc/rc.conf #
- ########################
- ip6mode="host"
- #ifconfig_wm0 static addresses for IPv4 and IPv6 are set in /etc/ifconfig.wm0
- defaultroute="192.168.1.1"
- defaultroute6="fe80::1%wm0"
- ...
- npf=YES
- npf_rules="/etc/npf.conf"
- #############################
- # part of /etc/ifconfig.wm0 #
- #############################
- inet 192.168.1.20 netmask 0xffffff00
- inet6 2001:fb1:138:760f:2cc7:1066:153f:e957 prefixlen 64
- up
- ############################
- # part of my /etc/npf.conf #
- ############################
- # /etc/npf.conf
- $ext_if4 = inet4(wm0)
- $ext_if6 = inet6(wm0)
- $services = { ftp, ssh, http }
- procedure "log" {
- log: npflog0
- }
- procedure "norm" {
- normalize: "random-id" #, "min-ttl" 512, "max-mss" 1432
- }
- group "external" on $ext_if4 {
- pass in final proto tcp to $ext_if4 port $services apply "log"
- pass in final proto tcp to $ext_if4 port 1024-65535 # Passive FTP
- pass in final proto udp to $ext_if4 port 33434-33600 # Traceroute
- pass final on $ext_if4 family inet4 proto icmp all # Ping
- pass stateful out final family inet4 proto tcp flags S/SA from $ext_if4 apply "norm"
- pass out final family inet4 proto tcp from $ext_if4 apply "norm"
- pass stateful out final family inet4 from $ext_if4 apply "norm"
- }
- group "external6" on $ext_if6 {
- pass in final proto tcp to $ext_if6 port $services apply "log"
- pass in final proto tcp to $ext_if6 port 1024-65535 # Passive FTP
- pass in final proto udp to $ext_if6 port 33434-33600 # Traceroute
- pass final on $ext_if6 family inet6 proto ipv6-icmp all # Ping
- pass stateful out final family inet6 proto tcp flags S/SA from $ext_if6 apply "norm"
- pass out final family inet6 proto tcp from $ext_if6 apply "norm"
- pass stateful out final family inet6 from $ext_if6 apply "norm"
- }
- group default {
- pass final on lo0 all
- block all apply "log"
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement