1 # $FreeBSD: src/share/examples/ipfilter/rules.txt,v 1.1.2.1 2002/04/27 20:04:18 darrenr Exp $
2 # $DragonFly: src/share/examples/ipfilter/rules.txt,v 1.2 2003/06/17 04:36:57 dillon Exp $
4 # block all incoming TCP packets on le0 from host "foo" to any destination.
6 block in on le0 proto tcp from foo/32 to any
8 ------------------------------------------------------------------------
11 # block all outgoing TCP packets on le0 from any host to port 23 of host bar.
13 block out on le0 proto tcp from any to bar/32 port != 23
15 ------------------------------------------------------------------------
18 # block all inbound packets.
20 block in from any to any
22 # pass through packets to and from localhost.
24 pass in from 127.0.0.1/32 to 127.0.0.1/32
26 # allow a variety of individual hosts to send any type of IP packet to any
29 pass in from 10.1.3.1 to any
30 pass in from 10.1.3.2 to any
31 pass in from 10.1.3.3 to any
32 pass in from 10.1.3.4 to any
33 pass in from 10.1.3.5 to any
34 pass in from 10.1.0.13/32 to any
35 pass in from 10.1.1.1/32 to any
36 pass in from 10.1.2.1/32 to any
39 # block all outbound packets.
41 block out from any to any
43 # allow any packets destined for localhost out.
45 pass out from any to 127.0.0.1/32
47 # allow any host to send any IP packet out to a limited number of hosts.
49 pass out from any to 10.1.3.1/32
50 pass out from any to 10.1.3.2/32
51 pass out from any to 10.1.3.3/32
52 pass out from any to 10.1.3.4/32
53 pass out from any to 10.1.3.5/32
54 pass out from any to 10.1.0.13/32
55 pass out from any to 10.1.1.1/32
56 pass out from any to 10.1.2.1/32
58 ------------------------------------------------------------------------
61 # block all ICMP packets.
63 block in proto icmp from any to any
65 ------------------------------------------------------------------------
70 # allow packets coming from foo to bar through.
74 # allow any TCP packets from the same subnet as foo is on through to host
75 # 10.1.1.2 if they are destined for port 6667.
77 pass proto tcp from fubar/24 to 10.1.1.2/32 port = 6667
79 # allow in UDP packets which are NOT from port 53 and are destined for
82 pass proto udp from fubar port != 53 to localhost
84 # block all ICMP unreachables.
86 block from any to any icmp unreach
88 # allow packets through which have a non-standard IP header length (ie there
89 # are IP options such as source-routing present).
91 pass from any to any with ipopts
93 ------------------------------------------------------------------------
96 # block all TCP packets with only the SYN flag set (this is the first
97 # packet sent to establish a connection).
99 block in proto tcp from any to any flags S/SA
101 ------------------------------------------------------------------------
104 # log all inbound packet on le0 which has IP options present
106 log in on le0 from any to any with ipopts
108 # block any inbound packets on le0 which are fragmented and "too short" to
109 # do any meaningful comparison on. This actually only applies to TCP
110 # packets which can be missing the flags/ports (depending on which part
111 # of the fragment you see).
113 block in log quick on le0 from any to any with short frag
115 # log all inbound TCP packets with the SYN flag (only) set
116 # (NOTE: if it were an inbound TCP packet with the SYN flag set and it
117 # had IP options present, this rule and the above would cause it
118 # to be logged twice).
120 log in on le0 proto tcp from any to any flags S/SA
122 # block and log any inbound ICMP unreachables
124 block in log on le0 proto icmp from any to any icmp-type unreach
126 # block and log any inbound UDP packets on le0 which are going to port 2049
129 block in log on le0 proto udp from any to any port = 2049
131 # quickly allow any packets to/from a particular pair of hosts
133 pass in quick from any to 10.1.3.2/32
134 pass in quick from any to 10.1.0.13/32
135 pass in quick from 10.1.3.2/32 to any
136 pass in quick from 10.1.0.13/32 to any
138 # block (and stop matching) any packet with IP options present.
140 block in quick on le0 from any to any with ipopts
142 # allow any packet through
144 pass in from any to any
146 # block any inbound UDP packets destined for these subnets.
148 block in on le0 proto udp from any to 10.1.3.0/24
149 block in on le0 proto udp from any to 10.1.1.0/24
150 block in on le0 proto udp from any to 10.1.2.0/24
152 # block any inbound TCP packets with only the SYN flag set that are
153 # destined for these subnets.
155 block in on le0 proto tcp from any to 10.1.3.0/24 flags S/SA
156 block in on le0 proto tcp from any to 10.1.2.0/24 flags S/SA
157 block in on le0 proto tcp from any to 10.1.1.0/24 flags S/SA
159 # block any inbound ICMP packets destined for these subnets.
161 block in on le0 proto icmp from any to 10.1.3.0/24
162 block in on le0 proto icmp from any to 10.1.1.0/24
163 block in on le0 proto icmp from any to 10.1.2.0/24
165 # Log all short TCP packets to qe3, with "packetlog" as the intended
166 # destination for the packet.
168 block in to qe3:packetlog proto tcp all with short
170 # Log all connection attempts for TCP
172 pass in dup-to le0:packetlog proto tcp all flags S/SA
174 # Route all UDP packets through transparently.
176 pass in fastroute proto udp all
178 # Route all ICMP packets to network 10 out through le1, to "router"
180 pass in to le1:router proto icmp all
182 ------------------------------------------------------------------------
183 Return to the IP Filter home page