blob: 87ae43ae2d80781ed1625d1bebae6ff0d045ce94 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
|
lan_if = "lan0"
wan_if = "brwan0"
# Default policy
set skip on lo
# Allow all traffic on $wan_if. Proper firewall rules are implemented in the ingress jail.
set skip on $wan_if
set block-policy return
scrub in
# Default block all
block in all
# Allow all outbound traffic
pass out all keep state
# Allow inbound HTTP/HTTPS on lan0
pass in on $lan_if proto tcp from any to ($lan_if) port { 80, 443 } keep state
# Allow SSH only on lan0
pass in on $lan_if proto tcp from any to ($lan_if) port 22 keep state
# Allow all ICMPv6 (required for IPv6 to function correctly)
pass inet6 proto ipv6-icmp from any to any keep state
# Allow all ICMPv4
pass inet proto icmp from any to any keep state
|
