From 7c5eae9294994e59a5176eba21093ecd6cdfcf63 Mon Sep 17 00:00:00 2001 From: Jan Tuomi Date: Mon, 29 Sep 2025 00:53:24 +0200 Subject: Improve jails --- templates/etc_pf.conf.j2 | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) (limited to 'templates/etc_pf.conf.j2') diff --git a/templates/etc_pf.conf.j2 b/templates/etc_pf.conf.j2 index 0bb7fef..a439702 100644 --- a/templates/etc_pf.conf.j2 +++ b/templates/etc_pf.conf.j2 @@ -7,13 +7,6 @@ set skip on lo set block-policy return scrub in -# Redirect HTTP to ingress jail -# TODO: fix these redirects, they seem to not work -rdr on $wan_if proto tcp from any to ($wan_if) port 80 -> $jail_ingress_ip port 80 -rdr on $wan_if proto tcp from any to ($wan_if) port 443 -> $jail_ingress_ip port 443 -rdr on $lan_if proto tcp from any to ($lan_if) port 80 -> $jail_ingress_ip port 80 -rdr on $lan_if proto tcp from any to ($lan_if) port 443 -> $jail_ingress_ip port 443 - # Default block all block in all @@ -21,7 +14,7 @@ block in all pass out all keep state # Allow inbound HTTP/HTTPS on both interfaces -pass in on $wan_if proto tcp from any to ($wan_if) port { 80, 443 } keep state +pass in on $wan_if proto tcp from any to any port { 80, 443 } keep state pass in on $lan_if proto tcp from any to ($lan_if) port { 80, 443 } keep state # Allow SSH only on lan0 -- cgit v1.3