pf=YES

# pfctl -e
# pfctl -d

1.1.2 Tệp cấu hình của PF

# pfctl -f /etc/pf.conf     Nạp tệp cấu hình pf.conf
# pfctl -nf /etc/pf.conf    Phân tích tệp cấu hình nhưng không nạp
# pfctl -Nf /etc/pf.conf    Chỉ nạp các quy tắc NAT của tệp cấu hình
# pfctl -Rf /etc/pf.conf    Chỉ nạp các quy tắc lọc gói của tệp cấu hình
# pfctl -sn                 Hiển thị các quy tắc NAT hiện tại 
# pfctl -sr                 Hiển thị các quy tắc lọc gói hiện tại
# pfctl -ss                 Hiển thị bảng trạng thái hiện tại
# pfctl -si                 Hiển thị thống kê và bộ đếm lọc gói
# pfctl -sa                 Hiển thị tất cả thông tin về PF

block out on fxp0 from { 192.168.0.1, 10.5.32.6 } to any

block out on fxp0 from 192.168.0.1 to any
block out on fxp0 from 10.5.32.6 to any

rdr on fxp0 proto tcp from any to any port { 22 80 } -> 192.168.0.6
block out on fxp0 proto { tcp udp } from { 192.168.0.1, 10.5.32.6 } \
to any port { ssh telnet }

trusted = "{ 192.168.1.2 192.168.5.36 }"
pass in inet proto tcp from { 10.10.0.0/24 $trusted } to port 22

pass in on fxp0 from { 10.0.0.0/8, !10.1.2.3 }

pass in on fxp0 from 10.0.0.0/8
pass in on fxp0 from !10.1.2.3

ext_if = "fxp0"
block in on $ext_if from any to any

friends = "{ 192.168.1.1, 10.0.2.5, 192.168.43.53 }"

host1 = "192.168.1.1"
host2 = "192.168.1.2"
all_hosts = "{" $host1 $host2 "}"

table <goodguys> { 192.0.2.0/24 }
table <rfc1918> const { 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8 }
table <spammers> persist
block in on fxp0 from { <rfc1918>, <spammers> } to any
pass  in on fxp0 from <goodguys> to any

table <goodguys> { 192.0.2.0/24, !192.0.2.5 }

table <spammers> persist file "/etc/spammers"
block in on fxp0 from <spammers> to any

# pfctl -t spammers -T add 218.70.0.0/16

# pfctl -t spammers -T show

# pfctl -t spammers -T delete 218.70.0.0/16

table <goodguys> { 172.16.0.0/16, !172.16.1.0/24, 172.16.1.100 }
block in on dc0 all
pass  in on dc0 from <goodguys> to any

action [direction] [log] [quick] [on interface] [af] [proto 
protocol] \
   [from src_addr [port src_port]] [to dst_addr [port dst_port]] \
   [flags tcp_flags] [state]

block in  all
block out all

# Pass traffic in on dc0 from the local network, 192.168.0.0/24,
# to the OpenBSD machine's IP address 192.168.0.1. Also, pass the
# return traffic out on dc0.
pass in  on dc0 from 192.168.0.0/24 to 192.168.0.1
pass out on dc0 from 192.168.0.1 to 192.168.0.0/24
# Pass TCP traffic in on fxp0 to the web server running on the
# OpenBSD machine. The interface name, fxp0, is used as the
# destination address so that packets will only match this rule if
# they're destined for the OpenBSD machine.
pass in on fxp0 proto tcp from any to fxp0 port www

block in on fxp0 proto tcp from any to any port ssh
pass  in all

block in quick on fxp0 proto tcp from any to any port ssh
pass  in all

pass out on fxp0 proto tcp from any to any keep state

pass out on fxp0 proto tcp from any to any

pass out on fxp0 proto { tcp, udp, icmp } from any to any modulate state

pass in on $ext_if proto tcp from any to $web_server port www \
   flags S/SA synproxy state

antispoof [log] [quick] for interface [af]

antispoof for fxp0 inet

block in quick from urpf-failed label uRPF

# pfctl -s osfp

pass  in on $ext_if from any os OpenBSD keep state
block in on $ext_if from any os "Windows 2000"
block in on $ext_if from any os "Linux 2.4 ts"
block in on $ext_if from any os unknown

pass in quick on fxp0 all allow-opts

ext_if  = "fxp0"
int_if  = "dc0"
lan_net = "192.168.0.0/24"
# table containing all IP addresses assigned to the firewall
table <firewall> const { self }
# don't filter on the loopback interface
set skip on lo0
# scrub incoming packets
scrub in all
# setup a default deny policy
block all
# activate spoofing protection for all interfaces
block in quick from urpf-failed
# only allow ssh connections from the local network if it's from the
# trusted computer, 192.168.0.15. use "block return" so that a TCP RST is
# sent to close blocked connections right away. use "quick" so that this
# rule is not overridden by the "pass" rules below.
block return in quick on $int_if proto tcp from ! 192.168.0.15 \
   to $int_if port ssh
# pass all traffic to and from the local network.
# these rules will create state entries due to the default
# "keep state" option which will automatically be applied.
pass in  on $int_if from $lan_net to any
pass out on $int_if from any to $lan_net
# pass tcp, udp, and icmp out on the external (Internet) interface. 
# tcp connections will be modulated, udp/icmp will be tracked
# statefully.
pass out on $ext_if proto { tcp udp icmp } all modulate state
# allow ssh connections in on the external interface as long as they're
# NOT destined for the firewall (i.e., they're destined for a machine on
# the local network). log the initial packet so that we can later tell
# who is trying to connect. use the tcp syn proxy to proxy the connection.
# the default flags "S/SA" will automatically be applied to the rule by
# PF.
pass in log on $ext_if proto tcp from any to ! <firewall> port ssh synproxy state

# sysctl net.inet.ip.forwarding=1
# sysctl net.inet6.ip6.forwarding=1 (if using IPv6)

net.inet.ip.forwarding=1
net.inet6.ip6.forwarding=1

nat [pass] [log] on interface [af] from src_addr [port src_port] to \
   dst_addr [port dst_port] -> ext_addr [pool_type] [static-port]

nat on tl0 from 192.168.1.0/24 to any -> 24.5.0.5

nat on tl0 from dc0:network to any -> tl0

nat on tl0 from dc0:network to any -> (tl0)

1.6.6 Ánh xạ chuyển hướng (ánh xạ 1:1)

# pfctl -s state
fxp0 TCP 192.168.1.35:2132 -> 24.5.0.5:53136 -> 65.42.33.245:22 
TIME_WAIT:TIME_WAIT
   fxp0 UDP 192.168.1.35:2491 -> 24.5.0.5:60527 -> 24.2.68.33:53   
MULTIPLE:SINGLE