pfctl -sr scrub all random-id fragment reassemble anchor "ftpsesame/*" all anchor "firewallrules" all block drop quick proto tcp from any port = 0 to any block drop quick proto tcp from any to any port = 0 block drop quick proto udp from any port = 0 to any block drop quick proto udp from any to any port = 0 block drop quick from <snort2c> to any label "Block snort2c hosts" block drop quick from any to <snort2c> label "Block snort2c hosts" anchor "loopback" all pass in quick on lo0 all flags S/SA keep state label "pass loopback" pass out quick on lo0 all flags S/SA keep state label "pass loopback" anchor "packageearly" all anchor "carp" all pass quick inet proto icmp from x.x.x.132 to any keep state anchor "dhcpserverlan" all pass in quick on le0 inet proto udp from any port = bootpc to 255.255.255.255 port = bootps keep state label "allow access to DHCP server on LAN" pass in quick on le0 inet proto udp from any port = bootpc to 192.168.22.2 port = bootps keep state label "allow access to DHCP server on LAN" pass out quick on le0 inet proto udp from 192.168.22.2 port = bootps to any port = bootpc keep state label "allow access to DHCP server on LAN" block drop in log quick on le1 inet proto udp from any port = bootps to 192.168.22.0/24 port = bootpc label "block dhcp client out wan" block drop in on ! le0 inet from 192.168.22.0/24 to any block drop in inet from 192.168.22.2 to any block drop in on le0 inet6 from fe80::20c:29ff:fef0:c9d4 to any anchor "spoofing" all anchor "spoofing" all block drop in on ! le1 inet from x.x.x.128/29 to any block drop in inet from x.x.x.132 to any block drop in on le1 inet6 from fe80::20c:29ff:fef0:c9de to any block drop in log quick on le1 inet from 10.0.0.0/8 to any label "block private networks from wan block 10/8" block drop in log quick on le1 inet from 127.0.0.0/8 to any label "block private networks from wan block 127/8" block drop in log quick on le1 inet from 172.16.0.0/12 to any label "block private networks from wan block 172.16/12" block drop in log quick on le1 inet from 192.168.0.0/16 to any label "block private networks from wan block 192.168/16" anchor "limitingesr" all block drop in quick from <virusprot> to any label "virusprot overload table" anchor "wanbogons" all block drop in log quick on le1 from <bogons> to any label "block bogon networks from wan" pass out quick on le0 proto icmp all keep state label "let out anything from firewall host itself" pass out quick on le1 proto icmp all keep state label "let out anything from firewall host itself" pass out quick on le1 all flags S/SA keep state (tcp.closed 5) label "let out anything from firewall host itself" anchor "firewallout" all pass out quick on le1 all flags S/SA keep state label "let out anything from firewall host itself" pass out quick on le0 all flags S/SA keep state label "let out anything from firewall host itself" pass out quick on enc0 all flags S/SA keep state label "IPSEC internal host to host" anchor "anti-lockout" all pass in quick on le0 inet from any to 192.168.22.2 flags S/SA keep state label "anti-lockout web rule" block drop in log quick proto tcp from <sshlockout> to any port = ssh label "sshlockout" anchor "ftpproxy" all anchor "pftpx/*" all pass in quick on le0 inet from 192.168.22.0/24 to any flags S/SA keep state label "USER_RULE: Default LAN -> any" pass in quick on le0 inet proto tcp from any to 127.0.0.1 port = ftp-proxy flags S/SA keep state label "FTP PROXY: Allow traffic to localhost" pass in quick on le0 inet proto tcp from any to 127.0.0.1 port = ftp flags S/SA keep state label "FTP PROXY: Allow traffic to localhost" pass in quick on le1 inet proto tcp from any port = ftp-data to (le1) port > 49000 flags S/SA keep state label "FTP PROXY: PASV mode data connection" anchor "imspector" all anchor "miniupnpd" all block drop in log quick all label "Default deny rule" block drop out log quick all label "Default deny rule"-- David L. Strout Engineering Systems Plus, LLC
----- Original Message ----- Subject: Re: Re: [pfSense Support] Reflective routing broken in newest 1.2.1-RC2 SNAP From: [EMAIL PROTECTED] To: [email protected] Date: 11-27-2008 7:34 pm > On Thu, Nov 27, 2008 at 6:16 PM, DLStrout <[EMAIL PROTECTED]> wrote: > > > Let me know if I can provide anything else. > > I want to see the working rule(s). > > Scott > > --------------------------------------------------------------------- > To unsubscribe, e-mail: [EMAIL PROTECTED] > For additional commands, e-mail: [EMAIL PROTECTED] > > Commercial support available - https://portal.pfsense.org --------------------------------------------------------------------- To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] Commercial support available - https://portal.pfsense.org
