diff options
Diffstat (limited to 'share/pf/faq-example3')
| -rw-r--r-- | share/pf/faq-example3 | 117 |
1 files changed, 117 insertions, 0 deletions
diff --git a/share/pf/faq-example3 b/share/pf/faq-example3 new file mode 100644 index 00000000000..696475385f2 --- /dev/null +++ b/share/pf/faq-example3 @@ -0,0 +1,117 @@ +# $OpenBSD: faq-example3,v 1.1 2003/08/02 18:25:49 henning Exp $ + +# +# Company Network +# + + +# enable queueing on the external interface to queue packets going out +# to the Internet. use the cbq scheduler so that the bandwidth use of +# each queue can be controlled. the max outgoing bandwidth is 1.5Mbps. + +altq on fxp0 cbq bandwidth 1.5Mb queue { std_ext, www_ext, boss_ext } + +# define the parameters for the child queues. +# std_ext - the standard queue. also the default queue for +# outgoing traffic on fxp0. +# www_ext - container queue for WWW server queues. limit to +# 500Kbps. +# www_ext_http - http traffic from the WWW server +# www_ext_misc - all non-http traffic from the WWW server +# boss_ext - traffic coming from the boss's computer + +queue std_ext cbq(default) +queue www_ext bandwidth 500Kb { www_ext_http, www_ext_misc } + queue www_ext_http priority 3 cbq(red) + queue www_ext_misc priority 1 +queue boss_ext priority 3 + +# enable queueing on the internal interface to control traffic coming +# from the Internet or the DMZ. use the cbq scheduler to control the +# bandwidth of each queue. bandwidth on this interface is set to the +# maximum. traffic coming from the DMZ will be able to use all of this +# bandwidth while traffic coming from the Internet will be limited to +# 1.0Mbps (because 0.5Mbps (500Kbps) is being allocated to fxp1). + +altq on dc0 cbq bandwidth 100% queue { net_int, www_int } + +# define the parameters for the child queues. +# net_int - container queue for traffic from the Internet. bandwidth +# is 1.0Mbps. +# std_int - the standard queue. also the default queue for outgoing +# traffic on dc0. +# it_int - traffic to the IT Dept network. +# boss_int - traffic to the boss's PC. +# www_int - traffic from the WWW server in the DMZ. + +queue net_int bandwidth 1.0Mb { std_int, it_int, boss_int } + queue std_int cbq(default) + queue it_int bandwidth 500Kb cbq(borrow) + queue boss_int priority 3 +queue www_int cbq(red) + +# enable queueing on the DMZ interface to control traffic destined for +# the WWW server. cbq will be used on this interface since detailed +# control of bandwidth is necessary. bandwidth on this interface is set +# to the maximum. traffic from the internal network will be able to use +# all of this bandwidth while traffic from the Internet will be limited +# to 500Kbps. + +altq on fxp1 cbq bandwidth 100% queue { internal_dmz, net_dmz } + +# define the parameters for the child queues. +# internal_dmz - traffic from the internal network. +# net_dmz - container queue for traffic from the Internet. +# net_dmz_http - http traffic. +# net_dmz_misc - all non-http traffic. this is also the default queue. + +queue internal_dmz # no special settings needed +queue net_dmz bandwidth 500Kb { net_dmz_http, net_dmz_misc } + queue net_dmz_http priority 3 cbq(red) + queue net_dmz_misc priority 1 cbq(default) + + +# ... in the filtering section of pf.conf ... + +main_net = "192.168.0.0/24" +it_net = "192.168.1.0/24" +int_nets = "{ 192.168.0.0/24, 192.168.1.0/24 }" +dmz_net = "10.0.0.0/24" + +boss = "192.168.0.200" +wwwserv = "10.0.0.100" + +# default deny +block on { fxp0, fxp1, dc0 } all + +# filter rules for fxp0 inbound +pass in on fxp0 proto tcp from any to $wwwserv port { 21, \ + > 49151 } flags S/SA keep state queue www_ext_misc +pass in on fxp0 proto tcp from any to $wwwserv port 80 \ + flags S/SA keep state queue www_ext_http + +# filter rules for fxp0 outbound +pass out on fxp0 from $int_nets to any keep state +pass out on fxp0 from $boss to any keep state queue boss_ext + +# filter rules for dc0 inbound +pass in on dc0 from $int_nets to any keep state +pass in on dc0 from $it_net to any queue it_int +pass in on dc0 from $boss to any queue boss_int +pass in on dc0 proto tcp from $int_nets to $wwwserv port { 21, 80, \ + > 49151 } flags S/SA keep state queue www_int + +# filter rules for dc0 outbound +pass out on dc0 from dc0 to $int_nets + +# filter rules for fxp1 inbound +pass in on fxp1 proto { tcp, udp } from $wwwserv to any port 53 \ + keep state + +# filter rules for fxp1 outbound +pass out on fxp1 proto tcp from any to $wwwserv port { 21, \ + > 49151 } flags S/SA keep state queue net_dmz_misc +pass out on fxp1 proto tcp from any to $wwwserv port 80 \ + flags S/SA keep state queue net_dmz_http +pass out on fxp1 proto tcp from $int_nets to $wwwserv port { 80, \ + 21, > 49151 } flags S/SA keep state queue internal_dmz |