Created
March 12, 2013 20:47
-
-
Save onlyhavecans/5146862 to your computer and use it in GitHub Desktop.
The difference between my firewall passing at <100kb and full speed....
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
--- /var/backups/etc_pf.conf.current Tue Mar 12 01:30:06 2013 | |
+++ /etc/pf.conf Tue Mar 12 13:17:50 2013 | |
@@ -5,6 +5,7 @@ | |
# in /etc/sysctl.conf if packets are to be forwarded between interfaces. | |
set skip on { lo, re1 } | |
+set block-policy return | |
# The interfaces | |
all_if = "{ egress, trusted, untrusted }" | |
@@ -24,15 +25,18 @@ | |
# NAT | |
match out on re0 from $allnet nat-to (re0) | |
+match in scrub (no-df reassemble tcp) | |
## Start Actual Rules! | |
block log all | |
+antispoof for egress | |
+pass quick on !egress inet proto udp from { 0.0.0.0, $allnet } \ | |
+ to { 255.255.255.255, trusted, untrusted } port { bootpc, bootps } | |
pass quick proto { tcp, udp } to $nameservers port domain | |
pass quick on { trusted, untrusted } inet proto icmp | |
-pass quick inet proto icmp from $allnet | |
# Router Restrict | |
-pass out on egress from ! self | |
+pass out on egress from !self | |
pass out on egress proto tcp from self to port ssh | |
pass out on egress proto { tcp, udp } from self to port $udp_services | |
pass out on egress proto { tcp, udp } from self to port $webports |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment