API tools faq
paste
Advertisement
Guest User

Untitled

a guest
Jun 22nd, 2017
76
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 5.89 KB | None | 0 0
raw download clone embed print report
  1. ip_gate = "9.9.9.9"
  2. ext_if = "xl0"
  3. flag1 =""
  4. flag = "flags S/SA keep state (source-track global, max-src-states 100, if-bound)"
  5. int_if = "xl1"
  6. ports="{1><24,26><444,446><65535}"
  7.  
  8.  
  9. prv_hosts = "192.168.0.0/24"
  10. unfiltered = "{lo0}"
  11. icmp_types = "{ 0, 8, 15, 30 }"
  12.  
  13. dl = "8192Kb"
  14. ul = "740Kb"
  15. noc_download = "1"
  16. noc_upload = "1"
  17.  
  18. set loginterface $ext_if
  19. set loginterface $int_if
  20.  
  21. set optimization aggressive
  22. set block-policy drop
  23. set require-order yes
  24. set limit frags 300000
  25. scrub in all fragment reassemble
  26. scrub out all fragment reassemble
  27.  
  28. #antispoof for $int_if
  29. #antispoof for $ext_if
  30.  
  31. altq on $int_if hfsc bandwidth $dl queue { def \
  32. _2 \
  33. _3 \
  34. _4 \
  35. _5 \
  36. _6 \
  37. _7 \
  38. _8 \
  39. _9 \
  40. _10 \
  41. }
  42. altq on $ext_if hfsc bandwidth $ul queue { defu \
  43. _2u \
  44. _3u \
  45. _4u \
  46. _5u \
  47. _6u \
  48. _7u \
  49. _8u \
  50. _9u \
  51. _10u \
  52. }
  53. queue def bandwidth 1% hfsc(default upperlimit 8192Kb)
  54. queue defu bandwidth 1% hfsc(default upperlimit 630Kb)
  55. queue _2 bandwidth 1% hfsc( upperlimit 850Kb )
  56. queue _2u bandwidth 1% hfsc( upperlimit 80Kb )
  57. queue _3 bandwidth 1% hfsc( upperlimit 900Kb )
  58. queue _3u bandwidth 1% hfsc( upperlimit 85Kb )
  59. queue _4 bandwidth 1% hfsc( upperlimit 800Kb )
  60. queue _4u bandwidth 1% hfsc( upperlimit 85Kb )
  61. queue _5 bandwidth 1% hfsc( upperlimit 800Kb )
  62. queue _5u bandwidth 1% hfsc( upperlimit 85Kb )
  63. queue _6 bandwidth 1% hfsc( upperlimit 800Kb )
  64. queue _6u bandwidth 1% hfsc( upperlimit 85Kb )
  65. queue _7 bandwidth 1% hfsc( upperlimit 500Kb )
  66. queue _7u bandwidth 1% hfsc( upperlimit 360Kb )
  67. queue _8 bandwidth 1% hfsc( upperlimit 800Kb )
  68. queue _8u bandwidth 1% hfsc( upperlimit 95Kb )
  69. queue _9 bandwidth 1% hfsc( upperlimit 500Kb )
  70. queue _9u bandwidth 1% hfsc( upperlimit 85Kb )
  71. queue _10 bandwidth 1% hfsc( upperlimit 800Kb )
  72. queue _10u bandwidth 1% hfsc( upperlimit 85Kb )
  73.  
  74. nat on $ext_if from $prv_hosts -> $ip_gate
  75.  
  76.  
  77. pass out quick on $ext_if inet from {$int_if} to any flags S/SA keep state
  78. pass in quick on $int_if inet proto tcp from any to 192.168.0.1 port 8080
  79. pass in quick on $int_if inet proto tcp from any to 127.0.0.1 port 8080
  80. #pass in quick on $ext_if inet proto udp from any port 53 to any label "DNS-in"
  81. pass in quick on $int_if inet proto tcp from $prv_hosts to $int_if port 22 label "ssh-int"
  82. pass in quick on $ext_if inet proto tcp from 0.0.0.0/0 to $ext_if port 22 label "ssh-ext"
  83. pass in quick on $ext_if inet proto { tcp, udp } from 0.0.0.0/0 to $ext_if port 161 label "snmp"
  84. pass in quick on $ext_if inet proto tcp from 0.0.0.0/0 to $ext_if port 80 label "ipfm-www"
  85. pass in quick inet proto icmp all icmp-type echoreq label "passed-icmp" modulate state
  86. pass out quick on $ext_if inet proto icmp from $ext_if to any keep state icmp-type $icmp_types label "snmp"
  87. block in quick on $ext_if inet proto tcp from any to any port {1080,3128,4588,6588,445,3306,134 >< 140} label "ms-ds-ext"
  88. block in quick on $ext_if inet proto udp from any to any port {1080,3128,4588,6588,445,3306,134 >< 140} label "ms-ds-ext"
  89. block in quick on $int_if inet proto tcp from any to any port {1080,3128,4588,6588,445,3306,134 >< 140} label "ms-ds"
  90. block in quick on $int_if inet proto udp from any to any port {1080,3128,4588,6588,445,3306,134 >< 140} label "ms-ds"
  91.  
  92. pass quick on $unfiltered label "loopback"
  93. block in quick on $ext_if inet from any to 255.255.255.255 label "broadcast"
  94. block in all label "blocked"
  95.  
  96.  
  97. pass in quick on $int_if inet proto {tcp,udp} from 192.168.0.2 to any port $ports $flag queue _2 tag host2
  98. pass out quick on $ext_if inet proto {tcp,udp} from $ext_if to any port $ports $flag queue _2u tagged host2
  99.  
  100. pass in quick on $int_if inet proto {tcp,udp} from 192.168.0.3 to any port $ports $flag queue _3 tag host3
  101. pass out quick on $ext_if inet proto {tcp,udp} from $ext_if to any port $ports $flag queue _3u tagged host3
  102.  
  103.  
  104. pass in quick on $int_if inet proto {tcp,udp} from 192.168.0.4 to any port $ports $flag queue _4 tag host4
  105. pass out quick on $ext_if inet proto {tcp,udp} from $ext_if to any port $ports $flag queue _4u tagged host4
  106.  
  107. pass in quick on $int_if inet proto {tcp,udp} from 192.168.0.5 to any port $ports $flag queue _5 tag host5
  108. pass out quick on $ext_if inet proto {tcp,udp} from $ext_if to any port $ports $flag queue _5u tagged host5
  109.  
  110. pass in quick on $int_if inet proto {tcp,udp} from 192.168.0.6 to any port $ports $flag queue _6 tag host6
  111. pass out quick on $ext_if inet proto {tcp,udp} from $ext_if to any port $ports $flag queue _6u tagged host6
  112.  
  113. pass in quick on $int_if inet proto {tcp,udp} from 192.168.0.7 to any port $ports $flag queue _7 tag host7
  114. pass out quick on $ext_if inet proto {tcp,udp} from $ext_if to any port $ports $flag queue _7u tagged host7
  115.  
  116. pass in quick on $int_if inet proto {tcp,udp} from 192.168.0.8 to any port $ports $flag queue _8 tag host8
  117. pass out quick on $ext_if inet proto {tcp,udp} from $ext_if to any port $ports $flag queue _8u tagged host8
  118.  
  119. pass in quick on $int_if inet proto {tcp,udp} from 192.168.0.9 to any port $ports $flag queue _9 tag host9
  120. pass out quick on $ext_if inet proto {tcp,udp} from $ext_if to any port $ports $flag queue _9u tagged host9
  121.  
  122. pass in quick on $int_if inet proto {tcp,udp} from 192.168.0.10 to any port $ports $flag queue _10 tag host10
  123. pass out quick on $ext_if inet proto {tcp,udp} from $ext_if to any port $ports $flag queue _10u tagged host10
  124.  
  125. #pass in log on $ext_if inet proto tcp from any to $int_if port 1:65535 keep state
  126.  
  127. #block in quick on $int_if from any to any
  128. pass in quick on $int_if from any to any label default
  129. pass out quick on $int_if from any to any label default-upload
  130. pass out on $ext_if from ($ext_if) to any keep state
  131.  
  132. antispoof for $int_if
  133. antispoof for $ext_if
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!