Before freebsd7.1, we need to implement the same functions as iproute2 in Linux: pf can be used to implement where the data is returned and where the data is returned. The specific method is as follows:
1: RC. conf
Set two IP addresses and one default route (note that the default route here is only relative to the route selected when the machine is accessed externally)
2: PF. conf
Tel_if = "em0 "#
Cnc_if = "Em1 "#
Loop_if = "lo0"
Gw_tel = "121.33.xx.xx"
Gw_cnc = "210.21.yy.yy"
Set Optimization aggressive
# Set timeout {interval 10, frag 30}
Set timeout {tcp. First 30, TCP. Opening 5, TCP. Established 1800}
# Set timeout {tcp. Closing 60, TCP. finwait 30, TCP. Closed 30}
# Set timeout {UDP. First 60, UDP. Single 30, UDP. Multiple 60}
# Set timeout {ICMP. First 20, ICMP. Error 10}
# Set timeout {Other. First 60, other. Single 30, other. Multiple 60}
# Set timeout {adaptive. Start 0, adaptive. End 0}
Scrub in all
# Block IP on the $ ext_if
Block in quick on {$ tel_if, $ cnc_if} from to any
Block all
Pass quick on $ loop_if all
#############################
# $ Tel_if
#############################
Block in quick on $ tel_if proto TCP all flags SF/sfra
Block in quick on $ tel_if proto TCP all flags sfup/sfrau
Block in quick on $ tel_if proto TCP all flags FPU/sfraup
Block in quick on $ tel_if proto TCP all flags/sfra
Block in quick on $ tel_if proto TCP all flags F/sfra
Block in quick on $ tel_if proto TCP all flags U/sfrau
# SSH, HTTP, SMTP, POP3, ftp
Pass in quick on $ tel_if proto TCP from $ tel_if: Network to any port {22,80, 443,25, 110,143} Keep state
Pass in quick on $ tel_if proto TCP from $ tel_if: Network to any port {21,49152: 65535} Keep state
# Other
Pass in quick on $ tel_if reply-to ($ tel_if $ gw_tel) proto TCP from any to any port {110,143, 80,443,} Keep state
Pass in quick on $ tel_if reply-to ($ tel_if $ gw_tel) proto TCP from any to any port {21,49152: 65535} Keep state
Pass in quick on $ tel_if reply-to ($ tel_if $ gw_tel) proto {TCP, UDP} from any to any port 53 keep state
Pass in quick on $ tel_if reply-to ($ tel_if $ gw_tel) proto ICMP from any to any ICMP-type 8 code 0 keep state
Pass out quick on $ tel_if all keep state
############################
# $ Cnc_if
############################
Block in quick on $ cnc_if proto TCP all flags SF/sfra
Block in quick on $ cnc_if proto TCP all flags sfup/sfrau
Block in quick on $ cnc_if proto TCP all flags FPU/sfraup
Block in quick on $ cnc_if proto TCP all flags/sfra
Block in quick on $ cnc_if proto TCP all flags F/sfra
Block in quick on $ cnc_if proto TCP all flags U/sfrau
# Other
Pass in quick on $ cnc_if reply-to ($ cnc_if $ gw_cnc) proto TCP from any to any port {110,143, 80,443,} Keep state
Pass in quick on $ cnc_if reply-to ($ cnc_if $ gw_cnc) proto TCP from any to any port {21,49152: 65535} Keep state
Pass in quick on $ cnc_if reply-to ($ cnc_if $ gw_cnc) proto {TCP, UDP} from any to any port 53 keep state
Pass in quick on $ cnc_if reply-to ($ cnc_if $ gw_cnc) proto ICMP from any to any ICMP-type 8 code 0 keep state
Pass out quick on $ cnc_if all keep state