1# $NetBSD: l2tp_gw-npf.conf,v 1.6 2016/02/06 20:19:28 riastradh Exp $ 2# 3# ex0 - (internal) network interface 4# 192.0.2.254/24 5# hme0 - (external) connection to Peer 6# 198.51.100.142/24 7 8$int_if = "ex0" 9$ext_if = "hme0" 10 11$private_addr = { 10.0.0.0/8, 172.16.0.0/14, 192.168.0.0/16 } 12 13alg "icmp" 14 15# 16# NAT for all. 17# 18map $ext_if dynamic 192.0.2.0/24 -> inet4($ext_if) 19 20#table <1> type tree file "/etc/npf_problem_sites" 21 22procedure "log" { 23 log: npflog0 24} 25 26group "external" on $ext_if { 27 # 28 # Allow DHCP requests (even to reserved addresses). 29 # 30 pass out final proto udp from any port bootpc to any port bootps 31 pass in final proto udp from any port bootps to any port bootpc 32 pass in final proto udp from any port bootps to 255.255.255.255 port bootpc 33 # 34 # Allow DNS queries 35 # 36 pass stateful out final proto udp to any port domain 37 38 # Problem sites. 39 #block in final from <1> apply "log" 40 41 # 42 # Block IANA-reserved addresses from entering or exiting 43 # 44 block in final from $private_addr apply "log" 45 block out final to $private_addr apply "log" 46 # 47 pass stateful out final proto tcp all 48 pass stateful out final proto udp all 49 pass stateful out final proto icmp all 50 pass stateful out final proto ipv6-icmp all 51 52 block in final proto tcp to 192.0.2.255 apply "log" 53 54 # 55 # Prevent IP spoofing attacks on the firewall. 56 # 57 block in final from 127.0.0.1 apply "log" 58 59 # 60 # L2TP/IPSEC-NAT-T Tunnels. 61 # 62 pass in final proto esp from any to inet4($ext_if) 63 pass out final proto esp from inet4($ext_if) to any 64 pass stateful in final from any to inet4($ext_if) port "ipsec-nat-t" 65 pass stateful in final from any to inet4($ext_if) port l2tp 66 67 # 68 # Pass multicast. 69 # IGMP uses 224.0.0.1. 70 # 71 pass in final proto igmp all 72 pass in final from any to 224.0.0.0/4 73 74 # 75 # Pass established connections. 76 # 77 pass in final proto tcp flags A/A all 78 pass in final proto tcp flags R/R all 79 # 80 # VNC 81 # 82 pass in final proto tcp from any to any port 5500 83 84 # 85 # Web servers 86 # 87 #pass in final proto tcp from any to <A>/<M> port http 88 89 # 90 # Services on localhost. 91 # 92 #pass in final proto udp from any port ntp 93 #pass in final to any port imap 94 #pass in final to any port domain 95 #pass in final proto tcp to any port smtp 96 #pass in final proto tcp to any port auth 97 #pass in final proto tcp to any port ssh 98 #pass in final proto tcp to any port bgp 99 #pass in final proto tcp to any port ftp 100 #pass in final proto tcp to any port "ftp-data" 101 #pass in final proto udp to any port isakmp 102 #pass in final proto udp to any port 8001 103 #pass in final proto tcp to inet4($ext_if) port www 104 105 # 106 # Handle traceroute gracefully for up-to 30 hops away. 107 # FIXME: port-unr for ICMP is not yet supported. 108 # 109 block return-icmp in final proto udp to any port 33433-33524 apply "log" 110 111 # 112 # Only allow selected ICMP types. 113 # 114 pass in final proto icmp icmp-type echo all 115 pass in final proto icmp icmp-type timxceed all 116 pass in final proto icmp icmp-type unreach all 117 pass in final proto icmp icmp-type echoreply all 118 pass in final proto icmp icmp-type sourcequench all 119 pass in final proto icmp icmp-type paramprob all 120 pass in final proto ipv6-icmp all 121 122 # 123 # Send back a reset for new connections on tcp. 124 # 125 block return-rst in final proto tcp flags S/SA all apply "log" 126} 127 128group "internal" on $int_if { 129 # Pass everything to internal networks, 130 # should be ok, because we are nat'ed. 131 pass final all 132} 133 134group default { 135 # Loopback interface should allows packets to traverse it. 136 pass final on lo0 all 137 # For one L2TP tunnel, needs interface pre-created, post-destroyed 138 pass final on ppp0 all 139 140 # 141 # Block everything by default. 142 # 143 block final all apply "log" 144} 145