74 lines
1.9 KiB
Django/Jinja
74 lines
1.9 KiB
Django/Jinja
######################
|
|
##### INTERFACES #####
|
|
######################
|
|
|
|
ext_if="{{ ansible_default_ipv4.device }}"
|
|
#lan_if="em1"
|
|
|
|
###########################
|
|
##### TABLES & LISTES #####
|
|
###########################
|
|
|
|
# Evolix
|
|
table <evolix> { {{ pf_trusted_ips }} }
|
|
|
|
# Port en entrée
|
|
# 2222 = ssh secondaire
|
|
# 5666 = nrpe
|
|
#tcp_in = "{ domain, ldap, ldaps, imap, imaps, pop3, pop3s, ssh, smtp, http, https, ftp, ftp-data, smtps, submission, 2222 }"
|
|
tcp_in = "{ http, https }"
|
|
|
|
# 33433><33626 = traceroute
|
|
#udp_in = "{ domain, ntp, 33433><33626 }"
|
|
udp_in = "{ 33433><33626 }"
|
|
|
|
###################
|
|
##### OPTIONS #####
|
|
###################
|
|
|
|
set block-policy return
|
|
set optimization normal
|
|
#set optimization aggressive
|
|
#set limit states 150000
|
|
#set limit src-nodes 25000
|
|
#set limit tables 10000
|
|
#set limit table-entries 3000
|
|
set skip on lo
|
|
match in all scrub (no-df)
|
|
|
|
###########################
|
|
##### FILTRAGE GLOBAL #####
|
|
###########################
|
|
|
|
# politique par defaut : on autorise l'icmp en entrée puis on ne filtre que le WAN en entrée, tout le reste est autorisé
|
|
block log all
|
|
pass out quick on $ext_if
|
|
#pass on $lan_if
|
|
pass in proto { icmp, icmp6 }
|
|
|
|
# filter rules and anchor for ftp-proxy(8)
|
|
#anchor "ftp-proxy/*"
|
|
#pass in quick inet proto tcp to port ftp divert-to 127.0.0.1 port 8021
|
|
|
|
#pass quick proto carp
|
|
#pass quick on $pfsync_if proto pfsync
|
|
|
|
# Autorisations pour Evolix
|
|
pass in on $ext_if proto tcp from <evolix> to (self) port { ssh, 5666 }
|
|
|
|
# Block Attack
|
|
# China 144.0.0.0/16 --> SSH
|
|
block in on $ext_if proto tcp from 144.0.0.0/16 to any port ssh
|
|
|
|
# Autorisation des protocoles en entrée
|
|
pass in on $ext_if proto tcp to !(self) port $tcp_in
|
|
pass in on $ext_if proto udp to !(self) port $udp_in
|
|
|
|
# FTP actif
|
|
# pass in on $ext_if proto tcp from any port 20 to any port 1024:65535
|
|
|
|
###############################
|
|
##### FILTRAGE SPECIFIQUE #####
|
|
###############################
|
|
|