diff options
Diffstat (limited to 'templates/etc_pf.conf.j2')
| -rw-r--r-- | templates/etc_pf.conf.j2 | 15 |
1 files changed, 4 insertions, 11 deletions
diff --git a/templates/etc_pf.conf.j2 b/templates/etc_pf.conf.j2 index ceae731..87ae43a 100644 --- a/templates/etc_pf.conf.j2 +++ b/templates/etc_pf.conf.j2 @@ -1,8 +1,10 @@ lan_if = "lan0" -wan_if = "wan0" +wan_if = "brwan0" # Default policy set skip on lo +# Allow all traffic on $wan_if. Proper firewall rules are implemented in the ingress jail. +set skip on $wan_if set block-policy return scrub in @@ -12,21 +14,12 @@ block in all # Allow all outbound traffic pass out all keep state -# Allow inbound HTTP/HTTPS on both interfaces -pass in on $wan_if proto tcp from any to any port { 80, 443 } keep state +# Allow inbound HTTP/HTTPS on lan0 pass in on $lan_if proto tcp from any to ($lan_if) port { 80, 443 } keep state # Allow SSH only on lan0 pass in on $lan_if proto tcp from any to ($lan_if) port 22 keep state -# Allow DHCPv4 (client side): from server port 67 to client port 68 -pass in quick on $lan_if proto udp from any port 67 to any port 68 keep state -pass in quick on $wan_if proto udp from any port 67 to any port 68 keep state - -# Allow DHCPv6 (client side): from server port 547 to client port 546 -pass in quick on $lan_if proto udp from any port 547 to any port 546 keep state -pass in quick on $wan_if proto udp from any port 547 to any port 546 keep state - # Allow all ICMPv6 (required for IPv6 to function correctly) pass inet6 proto ipv6-icmp from any to any keep state |