4. Ejemplo del uso de PF en una DMZ

Resumimos las secciones en orden y presentamos en orden y completo el archivo /etc/pf.conf que resultaría (adaptado de la Guía de PF):

# Recordar poner net.inet.ip.forwarding=1 and/or net.inet6.ip6.forwarding=1
# en /etc/sysctl.conf 

ext_if="dc1"  # Cambiar por interfaz externa
int_if="dc0"  # Cambiar por interfaz interna

int_ip="192.168.1.1"  # Cambiar por dirección en LAN
ext_ip="200.93.171.42"  # Cambiar por IP pública

# LAN
lan="192.168.1/24"

# Servicios que presta cortafuegos
servicios_tcp="{ssh,domain}" 
servicios_udp="{domain}" 
servicios_icmp="echoreq"

# Servidor interno
serv_ip="192.168.2.2"
servicios_serv="{ldap,smtp,www,https,imaps}"


set block-policy return
set loginterface $ext_if

set skip on {lo enc0}
scrub in all

match out on $ext_if from !($ext_if) nat-to ($ext_if:0)

pass in on $int_if proto tcp from $lan to any port ftp
match in on $int_if proto tcp from $lan to any port ftp rdr-to 127.0.0.1 port 8021

pass on $ext_if proto tcp from any to any port 80 
match in on $ext_if proto tcp from any to any port 80 rdr-to $serv_ip port 80
pass on $ext_if proto tcp from any to any port 443 
match in on $ext_if proto tcp from any to any port 443 rdr-to $serv_ip port 443
pass on $ext_if proto tcp from any to any port 993 
match in on $ext_if proto tcp from any to any port 993 rdr-to $serv_ip port 993
pass on $ext_if proto tcp from any to any port 10022 
match in on $ext_if proto tcp from any to any port 10022 rdr-to $serv_ip port 22
pass on $ext_if proto tcp from any to any port 10465 
match in on $ext_if proto tcp from any to any port 10465 rdr-to $serv_ip port 465
pass on $ext_if proto tcp from any to any port smtp 
match in on $ext_if proto tcp from any to any port smtp rdr-to $serv_ip port smtp
pass on $ext_if proto tcp from any to any port 389 
match in on $ext_if proto tcp from any to any port 389 rdr-to $serv_ip port 389 

#SECCION: REGLAS DE FILTRADO

block in log all 
pass out keep state

pass quick on { lo }
antispoof quick for { lo $int_if }

pass out proto tcp from $ext_ip to any port 21

pass in on $ext_if inet proto tcp from any to ($ext_if) \
	port $servicios_tcp keep state
pass in on $ext_if inet proto udp from any to ($ext_if) \
	port $servicios_udp keep state
pass in inet proto icmp all icmp-type $servicios_icmp keep state

pass in on $ext_if proto tcp from any to $serv_ip port $servicios_serv \
	flags S/SA synproxy state


pass in quick on $int_if

4.1. Referencias y lecturas recomendadas

Guía del usuario de PF [PF].