download

Chapter 12# Filteringpass out allblock in log allpass in quick on $ext_if proto tcp from any to $ext_if port 22pass out on $ext_if proto { tcp, udp } allpass in on $ext_if proto { tcp, udp } from any to port 80pass out on $ext_if from 192.168.0.0/24 to any queue datacenterpass out on $ext_if from 192.168.1.0/24 to any queue salesA typical PF configuration file consists of several sections, which are listed here:1. Macros2. Tables3. Options4. Scrub5. Queuing6. Translation7. Filter RulesNote that you should keep the same order of sections (if that section exists at all)within your configuration file.MacrosA Macro is actually a variable that you would use several times in your configurationfile. The macros are meant to simplify the task of administration. A typical exampleof using macro is for interface names and frequently used IP addresses and portnumbers as you saw in the above example. A macro is referenced later in theconfiguration with a leading "$" character. There is also the concept of "list" in theconfiguration, which is a list of items enclosed in "{" and "}" brackets. The list is thenexpanded into separate items when PF interprets the configuration files. You can usethe lists to simplify the configuration file and make it more compact. In the exampleabove, the line that contains a "list" is shown in the following code:pass out on $ext_if proto { tcp, udp } allThe above code is expanded into the following codes:pass out on $ext_if proto tcp allpass out on $ext_if proto udp all[ 195 ]