Voce testou essas regras antes de postar?
Simulou o ambiente?
m3
Em 8 de novembro de 2010 12:50, Gustavo Freitas
<gst.frei...@gmail.com> escreveu:
> Pessoal,
>
> Estou com iniciando no BSD e implementei um firewall usando PF, objetivo dele
> é
> somente controlar e dar prioridade para navegação na internet com uma
> reserva de banda
> de 80%, sem controle de trafego e nem bloqueio de portas.
>
> Gostaria da opinião de você e se esta correto..
>
> int_if = "rl0"
> ext_if = "vr0"
> unsafe = "{ rl0, vr0 }"
> int_net = "10.0.0.0/8"
> int_alias = "10.10.0.0/16"
>
>
> set loginterface $int_if
> set skip on lo
>
> match in all scrub (no-df)
>
> nat on $ext_if from !($ext_if) -> ($ext_if:0)
>
> antispoof quick for { lo $int_if }
>
> set block-policy return
>
> block in log quick proto tcp flags FUP/WEUAPRSF
> block in log quick proto tcp flags WEUAPRSF/WEUAPRSF
> block in log quick proto tcp flags SRAFU/WEUAPRSF
> block in log quick proto tcp flags /WEUAPRSF
> block in log quick proto tcp flags SR/SR
> block in log quick proto tcp flags SF/SF
>
> altq on $ext_if cbq bandwidth 512Kb queue { def, http }
> queue def bandwidth 20% cbq(default borrow red)
> queue http bandwidth 80% cbq(borrow red)
>
> pass in quick on $ext_if proto tcp from any to any port { 80, 443 } flags
> S/SA \
> keep state queue http
>
> # block in traffic from private networks on external interface
> block drop in quick on $ext_if from $int_alias to any
>
> # block out traffic to private networks on external interface
> block drop out quick on $ext_if from any to $int_alias
>
> antispoof quick for { lo $int_if }
> block in quick on $ext_if proto tcp from <sshguard> to any port 22
> label "ssh bruteforce"
>
> # SSH connection
> pass in log on $int_if inet proto tcp from $int_net to { $int_if
> $ext_if } port ssh
> pass out log on $int_if inet proto tcp from $int_if to any port ssh
>
> # DNS queries
> pass in log on $int_if proto { tcp udp } from $int_net to $ext_if port
> { domain bootps }
>
> # ping
> block in log on $int_if proto icmp from $int_alias to $int_alias
>
> # File sharing applications
> pass in log on $int_if proto { tcp udp } from $int_net to any port socks
>
>
>
> --
> Gustavo Freitas
> -------------------------
> Histórico: http://www.fug.com.br/historico/html/freebsd/
> Sair da lista: https://www.fug.com.br/mailman/listinfo/freebsd
>
--
Atenciosmente
Mario Augusto Mania <m3BSD>
-----------------------------------------------
m3.bsd.ma...@gmail.com
Cel.: (43) 9938-9629
Msn: ma...@oquei.com
-------------------------
Histórico: http://www.fug.com.br/historico/html/freebsd/
Sair da lista: https://www.fug.com.br/mailman/listinfo/freebsd
