blob: c0528e1c0c22998015ce40a59869980ed51c8812 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
|
{% for jail in jails -%}
{% if jail.name == 'ingress' -%}
# Interfaces & nets
lan = "epl{{ jail.num }}b"
wan = "epw{{ jail.num }}b"
lan_net = "{{ lan_ipv4_network }}"
table <blocked> persist
# Keep PF out of loopback, drop by default if you add blocks later
set skip on lo0
set block-policy drop
# NAT: translate LAN traffic to the WAN interface address
nat on $wan from $lan_net to any -> ($wan)
# Block traffic from IPs in the blocked table
block in quick from <blocked> to any
# Allow all outbound traffic from the jail and LAN via both interfaces
# NAT will be applied automatically when source is in $lan_net and going out $wan
pass out on $wan all keep state
pass out on $lan all keep state
pass in on $wan inet proto {tcp, udp} from any to any port {80, 443} keep state
{% endif %}
{% endfor %}
|
