PF Rules Untuk DMZ

Konfigurasi file "/etc/pf.conf"

extif1="fxp1"
extif2="fxp2"
intif="fxp0"

extaddr1="11.22.33.55"
extaddr2="66.77.88.100"

gw1="11.22.33.44"
gw2="66.77.88.99"

table <lanA> persist file "/etc/pf-files/lanA.txt"
table <lanB> persist file "/etc/pf-files/lanB.txt"
table <dstA> persist file "/etc/pf-files/dstA.txt"
table <dstB> persist file "/etc/pf-files/dstB.txt"
table <blacklist> persist file "/etc/pf-files/blacklist.txt"
table <rfc1918> {10.0.0.0/8,172.16.0.0/12,192.168.0.0/16}

allow_tcp = \
"{25,53,80,110,143,443,3128,3129,5000<>5100,6659<>6669,2086,2087,2082,2083,8021,8080,113,3306}"
allow_udp = "{53,161,162,123,5060,3477<>3480,7999<>10001,8080}"

proxy = "{3128,3129,8080}"

set skip on lo0
set loginterface {$extif1,$extif2}
scrub in all

#bandwidth management's declarations
#external interface queue
altq on {$extif1,$extif2} priq bandwidth 384Kb queue { q_ack, q_pri, q_def }

queue q_ack priority 10
queue q_pri priority 7
queue q_def priority 1 priq(default)

#internal interface queue
altq on $intif hfsc bandwidth 100Mb queue { def, ssh, ftp, kantor }

queue def bandwidth 1Mb priority 7 qlimit 5000 hfsc(red realtime 1Mb linkshare 1Mb upperlimit 3Mb default)
queue ftp bandwidth 10Mb priority 0 qlimit 50000 hfsc(red realtime 10Mb linkshare 10Mb upperlimit 30Mb)
queue ssh bandwidth 5Mb priority 0 qlimit 25000 hfsc(red realtime 5Mb linkshare 5Mb upperlimit 15Mb)
queue kantor bandwidth 5Mb priority 15 qlimit 20000 hfsc(red realtime 5Mb linkshare 5Mb upperlimit 10Mb)

nat-anchor "ftp-proxy/*"
rdr-anchor "ftp-proxy/*"
rdr on $intif proto tcp from any to any port 21 -> 127.0.0.1 port 8021

#the nat
nat on $extif1 from {<lanA>,<lanB>} to {<dstA>, !<rfc1918>} -> {$extaddr1}
nat on $extif2 from {<lanA>,<lanB>} to {<dstB>, !<rfc1918>} -> {$extaddr2}

nat on $extif1 from <lanA> to !<rfc1918> -> {$extaddr1}
nat on $extif2 from <lanB> to !<rfc1918> -> {$extaddr2}

antispoof log quick for $extif
#default block

block in log on $extif from any to any
block out log on $extif from any to any
block quick log from <blacklist> to any
block quick log from any to <blacklist>

#permanent block from RFC1918 ip address on external interface

block in quick log on $extif from <rfc1918> to any

#passing all acknowledged packets/ports

# passing ftp proxy

anchor "ftp-proxy/*"

#passing vpn

pass quick proto ipencap all queue (q_def, q_pri)

#ftp & ssh

pass quick proto tcp from any to any port {20,21} flags S/SA keep state queue ftp
pass quick proto tcp from any to any port {22,23} flags S/SA keep state queue ssh

# the load balancing

# cvsup
pass out quick on {$extif1,$extif2} proto {udp,tcp} from any to any port 5999 flags S/SA keep state queue (q_def, q_pri)
pass in quick on $intif route-to ($extif1 $gw1) proto {udp,tcp} from any to any port 5999 flags S/SA keep state queue kantor
pass in quick on $intif route-to ($extif2 $gw2) proto {udp,tcp} from any to any port 5999 flags S/SA keep state queue kantor

# proxy ports
pass out quick on {$extif1,$extif2} proto tcp from any to any port $proxy flags S/SA keep state queue (q_def, q_pri)
pass in quick on $intif route-to ($extif1 $gw1) proto tcp from any to any port $proxy flags S/SA keep state queue kantor
pass in quick on $intif route-to ($extif2 $gw2) proto tcp from any to any port $proxy flags S/SA keep state queue kantor

# allowed tcp ports
pass out quick on {$extif1,$extif2} proto tcp from any to any port $allow_tcp flags S/SA keep state queue (q_def, q_pri)
pass in quick on $intif route-to ($extif1 $gw1) proto tcp from any to any port $allow_tcp flags S/SA keep state queue kantor
pass in quick on $intif route-to ($extif2 $gw2) proto tcp from any to any port $allow_tcp flags S/SA keep state queue kantor

# allowed all icmp packets
pass out quick on {$extif1,$extif2} proto icmp from any to any keep state queue (q_def, q_pri)
pass in quick on $intif route-to ($extif1 $gw1) proto icmp from any to any keep state queue (q_def, q_pri)
pass in quick on $intif route-to ($extif2 $gw2) proto tcp from any to any port $proxy flags S/SA keep state queue kantor

# allowed udp ports
pass out quick on {$extif1,$extif2} proto udp from any to any port $allow_udp keep state queue (q_def, q_pri)
pass in quick on $intif route-to ($extif1 $gw1) proto udp from any to any port $allow_udp keep state queue def
pass in quick on $intif route-to ($extif2 $gw2) proto udp from any to any port $allow_udp keep state queue def

keterangan:

1. Pada block awal, adalah semua definisi variabel, mulai dari external interface, internal interface, ip address interface pertama, kedua dan ketiga, serta dua gateway di kedua ISP yang berbeda.


2. Table ip address disimpan dalam file-file yang ada pada direktori /etc/pf-files/, sehingga untuk menambah atau mengurangi semua daftar ip address tinggal mengedit file-file dalam direktori tersebut, lalu mereload PF.


3. Baris berikutnya adalah pendefinisian port-port tcp maupun udp yang diperbolehkan untuk lewat.


4. Untuk mencegah permasalahan pada FTP dibawah NAT, saya menggunakan cara yang sama seperti dengan cara yang pernah saya tulis sebelumnya.


5. Untuk interface-interface yang menghadap keluar, saya menggunakan ALTQ-PRIQ, sedangkan untuk yang kedalam saya menggunakan ALTQ-HFSC. (Courtesy to Mas Agung Duppy). Sedangkan untuk implementasinya adalah pada blok akhir dari rule ini.

SELAMAT MENCOBA!

• http://yulian.firdaus.or.id/2007/09/07/load-balance-speedy/


• http://www.openbsd.org/faq/pf/