[root@pfence var]# cat /usr/local/pf/conf/iptables.conf
# iptables template
# This file is manipulated on PacketFence's startup before being given to iptables
*filter

### INPUT ###
:INPUT DROP [0:0]
# accept loopback stuff
-A INPUT --in-interface lo --jump ACCEPT
#-A INPUT --in-interface eth0.4 --jump ACCEPT
# accept anything related
-A INPUT --match state --state ESTABLISHED,RELATED --jump ACCEPT
# Accept Ping (easier troubleshooting)
-A INPUT --protocol icmp --icmp-type echo-request --jump ACCEPT

#:INPUT ACCEPT [0:0]
#-A INPUT --in-interface eth0.4 --jump ACCEPT

:input-management-if - [0:0]
# SSH
-A input-management-if --match state --state NEW --match tcp --protocol tcp --dport 22 --jump ACCEPT
# HTTP and HTTPS for the portal
-A input-management-if --protocol tcp --match tcp --dport 80 --jump ACCEPT
-A input-management-if --protocol tcp --match tcp --dport 443 --jump ACCEPT
# Web Admin
-A input-management-if --protocol tcp --match tcp --dport %%web_admin_port%% --jump ACCEPT
# Webservices
-A input-management-if --protocol tcp --match tcp --dport %%webservices_port%% --jump ACCEPT
# AAA
-A input-management-if --protocol tcp --match tcp --dport %%aaa_port%% --jump ACCEPT
# PacketFence Status
-A input-management-if --protocol tcp --match tcp --dport %%status_port%% --jump ACCEPT
# httpd.portal modstatus
-A input-management-if --protocol tcp --match tcp --dport %%httpd_portal_modstatus%% --jump ACCEPT
# httpd.collector
-A input-management-if --protocol tcp --match tcp --dport %%httpd_collector_port%% --jump ACCEPT
# haproxy stats (uncomment if activating the haproxy dashboard)
#-A input-management-if --protocol tcp --match tcp --dport 1025 --jump ACCEPT
# GRAPHITE-WEB
-A input-management-if --protocol tcp --match tcp --dport 9000 --jump ACCEPT
# CARBON_CACHE
-A input-management-if --protocol tcp --match tcp --dport 2004 --jump ACCEPT
-A input-management-if --protocol tcp --match tcp --dport 7002 --jump ACCEPT

# RADIUS
-A input-management-if --protocol tcp --match tcp --dport 1812 --jump ACCEPT
-A input-management-if --protocol udp --match udp --dport 1812 --jump ACCEPT
-A input-management-if --protocol tcp --match tcp --dport 1813 --jump ACCEPT
-A input-management-if --protocol udp --match udp --dport 1813 --jump ACCEPT
-A input-management-if --protocol tcp --match tcp --dport 1815 --jump ACCEPT
-A input-management-if --protocol udp --match udp --dport 1815 --jump ACCEPT
# RADIUS (eduroam virtual-server)
%%eduroam_radius_virtualserver%%
# SNMP Traps
-A input-management-if --protocol udp --match udp --dport 162  --jump ACCEPT
# DHCP (for IP Helpers to mgmt to track users' IP in production VLANs)
-A input-management-if --protocol udp --match udp --dport 67  --jump ACCEPT
-A input-management-if --protocol tcp --match tcp --dport 67  --jump ACCEPT
# OpenVAS Administration Interface
-A input-management-if --protocol tcp --match tcp --dport 9392 --jump ACCEPT
# Nessus Administration Interface
-A input-management-if --protocol tcp --match tcp --dport 8834 --jump ACCEPT
# PacketFence-PKI
 -A input-management-if --protocol tcp --match tcp --dport 9393 --jump ACCEPT
 -A input-management-if --protocol tcp --match tcp --dport 9292 --jump ACCEPT
# LDAP
-A input-management-if --protocol tcp --match tcp --dport 389 --jump ACCEPT
# VRRP
-A input-management-if -d 224.0.0.0/8 -j ACCEPT
-A input-management-if -p vrrp -j ACCEPT
# Mysql
-A input-management-if --protocol tcp --match tcp --dport 3306 --jump ACCEPT

# Syslog
-A input-management-if --protocol udp --match udp --dport 514 --jump ACCEPT

:input-portal-if - [0:0]
-A input-portal-if --protocol tcp --match tcp --dport 80  --jump ACCEPT
-A input-portal-if --protocol tcp --match tcp --dport 443 --jump ACCEPT

:input-radius-if - [0:0]
-A input-radius-if --protocol tcp --match tcp --dport 1812 --jump ACCEPT
-A input-radius-if --protocol udp --match udp --dport 1812 --jump ACCEPT
-A input-radius-if --protocol tcp --match tcp --dport 1813 --jump ACCEPT
-A input-radius-if --protocol udp --match udp --dport 1813 --jump ACCEPT
-A input-radius-if --protocol tcp --match tcp --dport 1815 --jump ACCEPT
-A input-radius-if --protocol udp --match udp --dport 1815 --jump ACCEPT
%%eduroam_radius_listening%%

:input-internal-vlan-if - [0:0]
# DNS
-A input-internal-vlan-if --protocol tcp --match tcp --dport 53  --jump ACCEPT
-A input-internal-vlan-if --protocol udp --match udp --dport 53  --jump ACCEPT
# DHCP
-A input-internal-vlan-if --protocol udp --match udp --dport 67  --jump ACCEPT
-A input-internal-vlan-if --protocol tcp --match tcp --dport 67  --jump ACCEPT
# HTTP (captive-portal)
-A input-internal-vlan-if --protocol tcp --match tcp --dport 80  --jump ACCEPT
-A input-internal-vlan-if --protocol tcp --match tcp --dport 443 --jump ACCEPT
-A input-internal-vlan-if --protocol tcp --match tcp --dport 647 --jump ACCEPT
# HTTP (parking portal)
-A input-internal-vlan-if --protocol tcp --match tcp --dport 5252 --jump ACCEPT
%%input_inter_vlan_if%%


:input-internal-isol_vlan-if - [0:0]
# DNS
-A input-internal-isol_vlan-if --protocol tcp --match tcp --dport 53  --jump ACCEPT
-A input-internal-isol_vlan-if --protocol udp --match udp --dport 53  --jump ACCEPT
# DHCP
-A input-internal-isol_vlan-if --protocol udp --match udp --dport 67  --jump ACCEPT
-A input-internal-isol_vlan-if --protocol tcp --match tcp --dport 67  --jump ACCEPT
# HTTP (captive-portal)
-A input-internal-isol_vlan-if --protocol tcp --match tcp --dport 80  --jump ACCEPT
-A input-internal-isol_vlan-if --protocol tcp --match tcp --dport 443 --jump ACCEPT
-A input-internal-isol_vlan-if --protocol tcp --match tcp --dport 647 --jump ACCEPT
# HTTP (parking portal)
-A input-internal-isol_vlan-if --protocol tcp --match tcp --dport 5252 --jump ACCEPT
%%input_inter_isol_vlan_if%%

:input-internal-inline-if - [0:0]
# DHCP
-A input-internal-inline-if --protocol udp --match udp --dport 67  --jump ACCEPT
-A input-internal-inline-if --protocol tcp --match tcp --dport 67  --jump ACCEPT
# DNS
# allow unregistered users and isolated users to reach it for DNAT purposes but prevent registered ones
-A input-internal-inline-if --protocol tcp --match tcp --dport 53  --match mark --mark 0x3 --jump ACCEPT
-A input-internal-inline-if --protocol udp --match udp --dport 53  --match mark --mark 0x3 --jump ACCEPT
-A input-internal-inline-if --protocol tcp --match tcp --dport 53  --match mark --mark 0x2 --jump ACCEPT
-A input-internal-inline-if --protocol udp --match udp --dport 53  --match mark --mark 0x2 --jump ACCEPT
-A input-internal-inline-if --protocol tcp --match tcp --dport 53  --match mark --mark 0x1 --jump DROP
-A input-internal-inline-if --protocol udp --match udp --dport 53  --match mark --mark 0x1 --jump DROP
# HTTP (captive-portal)
# prevent registered users from reaching it
# TODO: Must work in dispatcher and Catalyst to redirect registered client out of the portal
#-A input-internal-inline-if --protocol tcp --match tcp --dport 80  --match mark --mark 0x1 --jump DROP
#-A input-internal-inline-if --protocol tcp --match tcp --dport 443 --match mark --mark 0x1 --jump DROP
# allow everyone else behind inline interface (not registered, isolated, etc.)
-A input-internal-inline-if --protocol tcp --match tcp --dport 80  --jump ACCEPT
-A input-internal-inline-if --protocol tcp --match tcp --dport 443 --jump ACCEPT
-A input-internal-inline-if --protocol tcp --match tcp --dport 647 --jump ACCEPT
%%input_inter_inline_rules%%

:input-highavailability-if - [0:0]
#SSH
-A input-highavailability-if --match state --state NEW --match tcp --protocol tcp --dport 22 --jump ACCEPT
#Galera cluster
-A input-highavailability-if --protocol tcp --match tcp --dport 4444 --jump ACCEPT
-A input-highavailability-if --protocol tcp --match tcp --dport 4567 --jump ACCEPT
-A input-highavailability-if --protocol tcp --match tcp --dport 4568 --jump ACCEPT
#PacketFence MariaDB Quorum server
-A input-highavailability-if --protocol tcp --match tcp --dport 7890 --jump ACCEPT
-A input-highavailability-if --protocol tcp --match tcp --dport 7891 --jump ACCEPT
# Corosync
-A input-highavailability-if --protocol udp --match udp --dport 5405 --jump ACCEPT
-A input-highavailability-if --protocol udp --match udp --dport 5407 --jump ACCEPT
#DRBD
-A input-highavailability-if --protocol tcp --match tcp --dport 7788 --jump ACCEPT
# Heartbeat
-A input-highavailability-if --protocol udp --match udp --dport 694 --jump ACCEPT
#PCS
-A input-highavailability-if --protocol tcp --match tcp --dport 2224 --jump ACCEPT
-A input-highavailability-if --protocol tcp --match tcp --dport 3121 --jump ACCEPT
-A input-highavailability-if --protocol tcp --match tcp --dport 21064 --jump ACCEPT

### FORWARD ###
:FORWARD DROP [0:0]
:forward-internal-vlan-if - [0:0]
%%filter_forward_vlan%%

:forward-internal-isolvlan-if - [0:0]
%%filter_forward_isol_vlan%%

:forward-internal-inline-if - [0:0]
%%filter_forward_inline%%

:OUTPUT ACCEPT [0:0]

# These will redirect to the proper chains based on conf/pf.conf's configuration
%%filter_if_src_to_chain%%
%%filter_forward_domain%%
COMMIT

*mangle
:PREROUTING ACCEPT [0:0]
:prerouting-int-inline-if - [0:0]
%%mangle_prerouting_inline%%
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:postrouting-int-inline-if - [0:0]
%%mangle_postrouting_inline%%
# These will redirect to the proper chains based on conf/pf.conf's configuration
%%mangle_if_src_to_chain%%
COMMIT

*nat
:PREROUTING ACCEPT [0:0]
:prerouting-int-inline-if - [0:0]
:postrouting-inline-routed - [0:0]
:postrouting-int-inline-if - [0:0]
:prerouting-int-vlan-if - [0:0]

%%nat_prerouting_inline%%
%%nat_prerouting_vlan%%

:OUTPUT ACCEPT [0:0]
# These will redirect to the proper chains based on conf/pf.conf's configuration
%%nat_if_src_to_chain%%


:POSTROUTING ACCEPT [0:0]

%%nat_postrouting_inline%%

#
# Chain to enable routing instead of NAT
#
%%routed_postrouting_inline%%

#
# NAT out (PAT actually)
#
# If you want to do your own thing regarding NAT like for example:
# - allowing through instead of doing NAT (make sure you have the proper return route)
# - traffic out on some interface other than management
# - overloading on multiple IP addresses
# Comment the next two lines and do it here on the POSTROUTING chain.
# Make sure to adjust the FORWARD rules also to allow traffic back-in.
%%nat_postrouting_vlan%%

#
# Routing for the hidden domain network
#
%%domain_postrouting%%
COMMIT