Skip to content

Instantly share code, notes, and snippets.

@onlyhavecans
Created March 12, 2013 20:47
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save onlyhavecans/5146862 to your computer and use it in GitHub Desktop.
Save onlyhavecans/5146862 to your computer and use it in GitHub Desktop.
The difference between my firewall passing at <100kb and full speed....
--- /var/backups/etc_pf.conf.current Tue Mar 12 01:30:06 2013
+++ /etc/pf.conf Tue Mar 12 13:17:50 2013
@@ -5,6 +5,7 @@
# in /etc/sysctl.conf if packets are to be forwarded between interfaces.
set skip on { lo, re1 }
+set block-policy return
# The interfaces
all_if = "{ egress, trusted, untrusted }"
@@ -24,15 +25,18 @@
# NAT
match out on re0 from $allnet nat-to (re0)
+match in scrub (no-df reassemble tcp)
## Start Actual Rules!
block log all
+antispoof for egress
+pass quick on !egress inet proto udp from { 0.0.0.0, $allnet } \
+ to { 255.255.255.255, trusted, untrusted } port { bootpc, bootps }
pass quick proto { tcp, udp } to $nameservers port domain
pass quick on { trusted, untrusted } inet proto icmp
-pass quick inet proto icmp from $allnet
# Router Restrict
-pass out on egress from ! self
+pass out on egress from !self
pass out on egress proto tcp from self to port ssh
pass out on egress proto { tcp, udp } from self to port $udp_services
pass out on egress proto { tcp, udp } from self to port $webports
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment