-
Notifications
You must be signed in to change notification settings - Fork 0
/
pf.conf
49 lines (41 loc) · 1.54 KB
/
pf.conf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
# options
set optimization normal
set block-policy return
set fingerprints "/etc/pf.os"
# definitions
pf_strict = "{ re0 wlan0 ue0 }"
ext_ifs = "{ re0 wlan0 ue0 }"
vm_if = "vnat0"
vm_net = "10.0.0.0/24"
table <goonlan> const { 192.168.100.0/24, 192.168.184.0/24, 192.168.55.0/24 }
icmp_types = "{ 0, 3, 4, 8, 11, 12 }"
# base rules
set skip on lo0
# translation
## VM networking
nat on re0 from $vm_if:network to any -> (re0)
nat on wlan0 from $vm_if:network to any -> (wlan0)
nat on ue0 from $vm_if:network to any -> (ue0)
# filter
## allow ICMP pings
pass in on $pf_strict inet proto icmp all icmp-type $icmp_types
# services (ssh, nfs, smb)
tcp_services = "{ ssh nfsd rpcbind 711 957 22000 21027 }"
udp_services = "{ nfsd rpcbind 711 957 22000 }"
# rules
## allow all incoming traffic, since they could be a response to outgoing connection
## but block our service ports, and then allow it only for goonlab
## DHCP
pass in quick on $pf_strict inet proto tcp from any port 67:68 to any port { 67 68 } keep state flags S/SA
pass in quick on $pf_strict inet proto udp from any port 67:68 to any port { 67 68 } keep state
# Mark incoming traffic as blocked
block in log on $pf_strict all
# Allow services from certain subnets
pass in on $pf_strict inet proto tcp from <goonlan> to any port $tcp_services
pass in on $pf_strict inet proto udp from <goonlan> to any port $udp_services
# Allow outgoing traffic
pass out on $pf_strict all
# TAILSCALE
block in log on tailscale0 all
pass in on tailscale0 inet proto tcp from any to any port 1337
pass out on tailscale0 all