diff options
| author | Jan Tuomi <jan@jantuomi.fi> | 2025-09-29 00:53:24 +0200 |
|---|---|---|
| committer | Jan Tuomi <jan@jantuomi.fi> | 2025-09-29 00:53:24 +0200 |
| commit | 7c5eae9294994e59a5176eba21093ecd6cdfcf63 (patch) | |
| tree | a3d7d0a34d6e4b9a773cd85b99afc9eca5b5bb9c /templates/etc_pf.conf.j2 | |
| parent | cc1b02f99e457d2a5a440698e9bae1ca30f408e1 (diff) | |
Improve jails
Diffstat (limited to 'templates/etc_pf.conf.j2')
| -rw-r--r-- | templates/etc_pf.conf.j2 | 9 |
1 files changed, 1 insertions, 8 deletions
diff --git a/templates/etc_pf.conf.j2 b/templates/etc_pf.conf.j2 index 0bb7fef..a439702 100644 --- a/templates/etc_pf.conf.j2 +++ b/templates/etc_pf.conf.j2 @@ -7,13 +7,6 @@ set skip on lo set block-policy return scrub in -# Redirect HTTP to ingress jail -# TODO: fix these redirects, they seem to not work -rdr on $wan_if proto tcp from any to ($wan_if) port 80 -> $jail_ingress_ip port 80 -rdr on $wan_if proto tcp from any to ($wan_if) port 443 -> $jail_ingress_ip port 443 -rdr on $lan_if proto tcp from any to ($lan_if) port 80 -> $jail_ingress_ip port 80 -rdr on $lan_if proto tcp from any to ($lan_if) port 443 -> $jail_ingress_ip port 443 - # Default block all block in all @@ -21,7 +14,7 @@ block in all pass out all keep state # Allow inbound HTTP/HTTPS on both interfaces -pass in on $wan_if proto tcp from any to ($wan_if) port { 80, 443 } keep state +pass in on $wan_if proto tcp from any to any port { 80, 443 } keep state pass in on $lan_if proto tcp from any to ($lan_if) port { 80, 443 } keep state # Allow SSH only on lan0 |