Resumimos las secciones en orden y presentamos en
orden y completo el archivo
/etc/pf.conf
que resultaría
(adaptado de la Guía de PF):
# Recordar poner net.inet.ip.forwarding=1 and/or net.inet6.ip6.forwarding=1 # en /etc/sysctl.conf ext_if="dc1" # Cambiar por interfaz externa int_if="dc0" # Cambiar por interfaz interna int_ip="192.168.1.1" # Cambiar por dirección en LAN ext_ip="200.93.171.42" # Cambiar por IP pública # LAN lan="192.168.1/24" # Servicios que presta cortafuegos servicios_tcp="{ssh,domain}" servicios_udp="{domain}" servicios_icmp="echoreq" # Servidor interno serv_ip="192.168.2.2" servicios_serv="{ldap,smtp,www,https,imaps}" set block-policy return set loginterface $ext_if set skip on {lo enc0} scrub in all # SECCIÓN nat/rdr nat on $ext_if from !($ext_if) -> ($ext_if:0) nat-anchor "ftp-proxy/*" rdr-anchor "ftp-proxy/*" rdr pass on $int_if proto tcp from $lan to any port ftp -> 127.0.0.1 port 8021 rdr pass on $ext_if proto tcp from any to any port 80 -> $serv_ip port 80 rdr pass on $ext_if proto tcp from any to any port 443 -> $serv_ip port 443 rdr pass on $ext_if proto tcp from any to any port 993 -> $serv_ip port 993 rdr pass on $ext_if proto tcp from any to any port 10022 -> $serv_ip port 22 rdr pass on $ext_if proto tcp from any to any port 10465 -> $serv_ip port 465 rdr pass on $ext_if proto tcp from any to any port smtp -> $serv_ip port smtp rdr pass on $ext_if proto tcp from any to any port 389 -> $serv_ip port 389 #SECCION: REGLAS DE FILTRADO block in log all pass out keep state pass quick on { lo } antispoof quick for { lo $int_if } anchor "ftp-proxy/*" pass out proto tcp from $ext_ip to any port 21 pass in on $ext_if inet proto tcp from any to ($ext_if) \ port $servicios_tcp keep state pass in on $ext_if inet proto udp from any to ($ext_if) \ port $servicios_udp keep state pass in inet proto icmp all icmp-type $servicios_icmp keep state pass in on $ext_if proto tcp from any to $serv_ip port $servicios_serv \ flags S/SA synproxy state pass in quick on $int_if
Guía del usuario de PF [PF].