Use pf to implement multiple route tables

Source: Internet
Author: User

Before freebsd7.1, we need to implement the same functions as iproute2 in Linux: pf can be used to implement where the data is returned and where the data is returned. The specific method is as follows:
1: RC. conf
Set two IP addresses and one default route (note that the default route here is only relative to the route selected when the machine is accessed externally)
2: PF. conf
Tel_if = "em0 "#
Cnc_if = "Em1 "#
Loop_if = "lo0"
Gw_tel = "121.33.xx.xx"
Gw_cnc = "210.21.yy.yy"
Set Optimization aggressive
# Set timeout {interval 10, frag 30}
Set timeout {tcp. First 30, TCP. Opening 5, TCP. Established 1800}
# Set timeout {tcp. Closing 60, TCP. finwait 30, TCP. Closed 30}
# Set timeout {UDP. First 60, UDP. Single 30, UDP. Multiple 60}
# Set timeout {ICMP. First 20, ICMP. Error 10}
# Set timeout {Other. First 60, other. Single 30, other. Multiple 60}
# Set timeout {adaptive. Start 0, adaptive. End 0}
Scrub in all
# Block IP on the $ ext_if
Block in quick on {$ tel_if, $ cnc_if} from to any
Block all
Pass quick on $ loop_if all
#############################
# $ Tel_if
#############################
Block in quick on $ tel_if proto TCP all flags SF/sfra
Block in quick on $ tel_if proto TCP all flags sfup/sfrau
Block in quick on $ tel_if proto TCP all flags FPU/sfraup
Block in quick on $ tel_if proto TCP all flags/sfra
Block in quick on $ tel_if proto TCP all flags F/sfra
Block in quick on $ tel_if proto TCP all flags U/sfrau
# SSH, HTTP, SMTP, POP3, ftp
Pass in quick on $ tel_if proto TCP from $ tel_if: Network to any port {22,80, 443,25, 110,143} Keep state
Pass in quick on $ tel_if proto TCP from $ tel_if: Network to any port {21,49152: 65535} Keep state
# Other
Pass in quick on $ tel_if reply-to ($ tel_if $ gw_tel) proto TCP from any to any port {110,143, 80,443,} Keep state
Pass in quick on $ tel_if reply-to ($ tel_if $ gw_tel) proto TCP from any to any port {21,49152: 65535} Keep state
Pass in quick on $ tel_if reply-to ($ tel_if $ gw_tel) proto {TCP, UDP} from any to any port 53 keep state
Pass in quick on $ tel_if reply-to ($ tel_if $ gw_tel) proto ICMP from any to any ICMP-type 8 code 0 keep state
Pass out quick on $ tel_if all keep state
############################
# $ Cnc_if
############################
Block in quick on $ cnc_if proto TCP all flags SF/sfra
Block in quick on $ cnc_if proto TCP all flags sfup/sfrau
Block in quick on $ cnc_if proto TCP all flags FPU/sfraup
Block in quick on $ cnc_if proto TCP all flags/sfra
Block in quick on $ cnc_if proto TCP all flags F/sfra
Block in quick on $ cnc_if proto TCP all flags U/sfrau
# Other
Pass in quick on $ cnc_if reply-to ($ cnc_if $ gw_cnc) proto TCP from any to any port {110,143, 80,443,} Keep state
Pass in quick on $ cnc_if reply-to ($ cnc_if $ gw_cnc) proto TCP from any to any port {21,49152: 65535} Keep state
Pass in quick on $ cnc_if reply-to ($ cnc_if $ gw_cnc) proto {TCP, UDP} from any to any port 53 keep state
Pass in quick on $ cnc_if reply-to ($ cnc_if $ gw_cnc) proto ICMP from any to any ICMP-type 8 code 0 keep state
Pass out quick on $ cnc_if all keep state

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.