69 lines
2.3 KiB
Text
69 lines
2.3 KiB
Text
|
# /etc/pf.conf — edge box default-deny + nat + WG passthrough
|
||
|
|
#
|
||
|
|
# Layout:
|
||
|
|
# egress = WAN-side NIC (public IP from ISP/router)
|
||
|
|
# lan = LAN-side NIC (192.168.0.0/24, internal LAN)
|
||
|
|
# wg0 = WireGuard tunnel to nullstone (private /29 subnet, e.g. 10.10.10.0/29)
|
||
|
|
#
|
||
|
|
# Adjust interface names per `ifconfig` output on the T5600 (likely em0+em1).
|
||
|
|
|
||
|
|
# === Macros ===
|
||
|
|
ext_if = "em0" # WAN-side
|
||
|
|
int_if = "em1" # LAN-side
|
||
|
|
wg_if = "wg0"
|
||
|
|
nullstone = "10.10.10.2" # nullstone over WG; edge is 10.10.10.1
|
||
|
|
|
||
|
|
# === Tables ===
|
||
|
|
# Bogus / non-routable; martians; tor-exit if you want to block (left empty)
|
||
|
|
table <bogons> persist file "/etc/pf-bogons"
|
||
|
|
table <bruteforce> persist
|
||
|
|
|
||
|
|
# === Options ===
|
||
|
|
set skip on lo
|
||
|
|
set block-policy drop
|
||
|
|
set loginterface egress
|
||
|
|
set syncookies adaptive (start 25%, end 12%)
|
||
|
|
|
||
|
|
# === Normalisation ===
|
||
|
|
match in all scrub (no-df random-id max-mss 1440)
|
||
|
|
|
||
|
|
# === Default deny ===
|
||
|
|
block in log all
|
||
|
|
block out log all
|
||
|
|
pass out quick on $ext_if from ($ext_if:0) keep state
|
||
|
|
|
||
|
|
# === Anti-spoof / bogon drop on WAN ===
|
||
|
|
antispoof quick for { $ext_if $int_if }
|
||
|
|
block in quick on $ext_if from <bogons> to any
|
||
|
|
block in quick on $ext_if from any to <bogons>
|
||
|
|
|
||
|
|
# === Inbound: 80/443 ports → relayd → backend over wg0 ===
|
||
|
|
# relayd binds to ($ext_if) on these ports; pass traffic to it explicitly.
|
||
|
|
pass in on $ext_if proto tcp to ($ext_if) port { 80 443 } \
|
||
|
|
flags S/SA modulate state \
|
||
|
|
(max-src-conn 100, max-src-conn-rate 60/10, \
|
||
|
|
overload <bruteforce> flush global)
|
||
|
|
|
||
|
|
# === Inbound SSH: rate-limit + bruteforce trap ===
|
||
|
|
pass in on $ext_if proto tcp to ($ext_if) port 22 \
|
||
|
|
flags S/SA modulate state \
|
||
|
|
(max-src-conn 5, max-src-conn-rate 3/30, \
|
||
|
|
overload <bruteforce> flush global)
|
||
|
|
block in quick from <bruteforce>
|
||
|
|
|
||
|
|
# === WireGuard: allow UDP 51820 from anywhere (handshake) ===
|
||
|
|
pass in on $ext_if proto udp to ($ext_if) port 51820 keep state
|
||
|
|
|
||
|
|
# === Tunnel traffic: pass freely between edge and nullstone ===
|
||
|
|
pass on $wg_if all keep state
|
||
|
|
pass quick proto { tcp udp icmp } from $nullstone to ($wg_if) keep state
|
||
|
|
|
||
|
|
# === LAN side: trust LAN, allow outbound + DNS to unbound ===
|
||
|
|
pass on $int_if all keep state
|
||
|
|
|
||
|
|
# === ICMP for path-MTU + diagnostics ===
|
||
|
|
pass inet proto icmp icmp-type { echoreq unreach timex } keep state
|
||
|
|
|
||
|
|
# === Logging ===
|
||
|
|
# `pflog0` interface captures matched-`log` rules. tcpdump -ni pflog0 to watch.
|