[FUG-BR] PF PPTP

[Nilton Carlos Pavan]

Segue


#REDE  ######################################
ext_if="vr1"
int_if="re0"

int_addr="192.168.1.254"
int_net="192.168.1.0/24"
ext_addr="200.1xxxxx"
tcp_in="{21,20,1723,5900}"
tcp_in_int="{3128,21}"
tcp_out_block="{8080,3128}"
connect="{200.2xxxx}"


#NORMALIZANDO TRAFEGO #########################

set timeout { tcp.first 60 tcp.opening 15 tcp.established 86400 \
            tcp.closing 300 tcp.finwait 15 tcp.closed 15 }
set timeout { udp.first 30 udp.single 15 udp.multiple 30 }
set timeout { icmp.first 10 icmp.error 5 }
set timeout { other.first 30 other.single 15 other.multiple 30 }
set timeout { frag 30 interval 10 }
set limit { states 50000 frags 25000 }
set optimization aggressive
set loginterface $ext_if
set loginterface $int_if
set block-policy return
set require-order yes
scrub all fragment reassemble random-id no-df

#NAT #########################################
nat-anchor "ftp-proxy/*"
nat on $ext_if from $int_net to any -> $ext_if


rdr-anchor "ftp-proxy/*"

rdr on $int_if inet proto tcp from any to any port ftp -> 127.0.0.1 port
8021
rdr on $int_if inet proto tcp from any to any port 80 -> 127.0.0.1 port 3128


#PADROES #####################################
block in log on $ext_if
pass quick on lo0 all
pass quick on $int_if all
antispoof quick for {$int_if, $ext_if} inet
pass out on $ext_if keep state


anchor "ftp-proxy/*"
pass quick proto tcp from $int_net to 127.0.0.1 port 8021 keep state

#SERVICOS EXTERNOS #############################
pass in quick on $ext_if proto gre from any to any keep state
pass in quick on $ext_if proto tcp from any to any port $tcp_in keep state
pass in quick on $ext_if proto tcp from any to any port 10050 >< 10080 keep
state

#BLOQUEIO DE REDE PARA EXTERNO ##############
pass in quick on $int_if proto tcp from $int_net to $int_addr port
$tcp_in_int
#block log quick on $int_if proto tcp from $int_net to any port
$tcp_out_block




Agradeço


2009/10/20 Thiago Gomes <thiagomespb em gmail.com>

> mande suas regras PF o erro deve esta nelas
>
> 2009/10/20 Nilton Carlos Pavan <niltonpavan em gmail.com>
> >
> > Boa tarde a todos...
> > Tenho um server BSD 6.4 com serviço de pptp (poptop) instalado..
> > Antes utilizava o ipfw como firewall deste server agora passei a usar o
> pf
> > (muito bom por sinal [?] ), mas como nem tudo é simples rsss está
> ocorrendo
> > problemas com a vpn.
> > Os clientes conectam na vpn, autentica, atribui ip só que não exergam a
> rede
> > interna (ping por exemplo), se eu desabilito o pf volta ao normal.
> >
> > Alguém poderia me dar uma luz?
> >
> > Agradeço desde já.
> >
> > []s
> >
> > Nilton Pavan
> >
> > -------------------------
> > Histórico: http://www.fug.com.br/historico/html/freebsd/
> > Sair da lista: https://www.fug.com.br/mailman/listinfo/freebsd
> >
>
>
>
> --
> Thiago Gomes
> -------------------------
> Histórico: http://www.fug.com.br/historico/html/freebsd/
> Sair da lista: https://www.fug.com.br/mailman/listinfo/freebsd
>