download

Network Configuration—FirewallsPF Configuration SyntaxCompared to the IPFW, PF has a complex syntax. However, with greater complexitycomes greater flexibility. Creating a PF configuration file is very similar to writingshell scripts. This is because, PF takes advantage of Macros, Tables, and many otheradvanced features that we will learn in this chapter.PF has many configuration options and advanced features that we willnot cover in this chapter. It is recommended that you read the official PFFAQ at http://www.openbsd.org/faq/pf for more up-to-date andin-depth information about PF.We will create a typical PF configuration sample in this chapter and discuss theanatomy and syntax of the configuration file:# Macrosext_if="fxp0"int_if="bge0"internal_net="192.168.10.0/24"external_addr="192.168.1.1"# Tablestable { 192.168.32.0/19, !192.168.35.0/24, 192.168.0.0/24,192.168.1.18 }# Optionsset loginterface $ext_ifset block-policy drop# Scrubscrub in all# Queueingaltq on $ext_if bandwidth 8Mb cbq queue { other, datacenter, sales }queue other bandwidth 5% cbq(default)queue sales bandwidth 15%queue datacenter bandwidth 80%# Translationnat on $ext_if from $internal_net to any -> ($ext_if)rdr on $ext_if proto tcp from any to $external_addr/32 port 1234 ->10.1.1.1 port 5678[ 194 ]