Use PF firewall on FreeBSD6.2

FreeBSD6.2 uses the PF firewall-Linux Enterprise Application-Linux server application information. The following is a detailed description. There are two methods to use the PF firewall on FreeBSD 6.2. One is to compile the firewall into the core, and the other is to load the firewall in the dynamic module mode. How to compile data into the core
# FreeBSD log traffic. If pflog is used, it must be compiled into the core
Device bpf
# Start PF Firewall
Device pf
# Start a virtual network device to record traffic (through bpf)
Device pflog
# Start a virtual network device to monitor the network status
Device pfsync

Load with dynamic modules
Vi/etc/rc. conf
Add the following four lines
# Enable PF
Pf_enable = "YES"
# PF firewall rule setting file
Pf_rules = "/etc/pf. conf"
# Enable the inetd service
Inetd_enable = "YES"
# Start pflogd
Pflog_enable = "YES"
# Where pflogd stores Record Files
Pflog_logfile = "/var/log/pflog"
# Transfer packets
Gateway_enable = "YES"

# Enable ftp-proxy
Vi/etc/inetd. conf
Delete the # At the top of the line below
Ftp-proxy stream tcp nowait root/usr/libexec/ftp-proxy

Use sysctl for setting (you can also restart the system to make the setting take effect)
Sysctl-w net. inet. ip. forwarding = 1

Vi/etc/pf. conf
# External network card
Ext_if = "sis0"
# Internal network card
Int_if = "rl0"

# Bandwidth control
# Define the total std_out bandwidth of KB
# Altq on $ ext_if cbq bandwidth 512Kb queue {std_out}
# Define the bandwidth of the std_out queue in KB and use the default queue
# Queue std_out bandwith 256Kb cbq (default)
# Define the total std_in bandwidth of 2 Mb
# Altq on $ int_if cbq bandwidth 2 Mb queue {std_in}
# If the bandwidth is sufficient, you can borrow extra bandwidth from the parent queue.
# Queue std_in bandwidth 768Kb cbq (brrrow)

# External services
Open_services = "{80,443 }"
# Private IP Address
Priv_nets = "{127.0.0.0/8, 192.168.0.0/16,172.16 .0.0/12, 10.0.0.0/8 }"

# Options
# Set the method for rejecting online packets
Set block-policy return
#
Set optimization aggressive
# Record $ ext_if
Set loginterface $ ext_if

# Scrub
# Organize packets
Scrub in all

# Nat
# NAT address translation Processing
Nat on $ ext_if from $ int_if: network to any-> $ ext_if

# Ftp-proxy
# Ftp-proxy Redirection
Rdr on $ int_if proto tcp from any to any port 21-> 127.0.0.1 port 8021
# Rdr on $ ext_if proto tcp from any to 140.111.152.13 port 21-> 192.168.13.253 port 21
# Transparent Proxy Server
Rdr on rl0 proto tcp from 192.168.20./ 24 to any 80-> 127.0.0.1 port 3128

# Block suspicious packets from the $ ext_if Nic
Antispoof log quick for $ ext_if

# Block all incoming and outgoing packets
Block all

# Open loopback
Pass quick on lo0 all

# Reject internal private IP addresses from connecting to the $ ext_if network card
Block drop in quick on $ ext_if from $ priv_nets to any
Block drop out quick on $ ext_if from any to $ priv_nets

# Open 80,443 ports
Pass in on $ ext_if inet proto tcp from any to $ ext_if port $ open_services flags S/SA keep state
# Only the CIDR Block 140.111.152.0/24 can be connected to the local machine through 22 ports.
Pass in on $ ext_if inet proto tcp from 140.111.152.0/24 to $ ext_if port 22 flags S/SA keep state

# Open internal network for external connection
# Pass in on $ inf_if proto rcp from any to any queue std_in
Pass in on $ int_if from $ int_if: network to any keep state
Pass out on $ int_if from any to $ int_if: network keep state

# Open external network connection
# Pass out $ ext_if proto tcp from any to any queue std_out
Pass out on $ ext_if proto tcp all modulate state flags S/SA
Pass out on $ ext_if proto {udp, icmp} all keep state

Start PF and read pf rules
Pfctl-e; pfctl-f/etc/pf. conf

PF command usage
# Start PF
Pfctl-e
# Loading PF rules
Pfctl-f/etc/pf. conf
# Check whether the PF syntax is correct (not loaded)
Pfctl-nf/etc/pf. conf
# Stop PF
Pfctl-d
# Repeat the NAT section in the PF configuration file
Pfctl-f/etc/pf. conf-N
# Re-reading the filter rules in the PF configuration file
Pfctl-f/etc/pf. conf-R
# Re-reading the option rules in the PF setting file
Pfctl-f/etc/pf. conf-O

# Viewing PF Information
# Display statistics of current filtered packets
Pfctl-s info
Pfctl-si

Pfctl-s memory

# Display current filtering rules
Pfctl-s rules
Pfctl-sr

Pfctl-vs rules

# Display statistics of current filtered packets
Pfctl-vsr

# Display current NAT rules
Pfctl-s nat
Pfctl-sn

# View current queue
Pfctl-s queue

# Display all statistics at the current stage
Pfctl-s all
Pfctl-sa

# Clear PF rules
# Clearing NAT rules
Pfctl-F nat
# Clearing a queue
Pfctl-F queue
# Clearing packet filtering rules
Pfctl-F rules
# Clearing counters
Pfctl-F info
Pfctl-F Tables
# Clear all rules
Pfctl-F all

# Use of PF Tables
# Displaying table data
Pfctl-t ssh-bruteforce-Tshow
Pfctl-t table_name-T add spammers.org
Pfctl-t table_name-T delete spammers.org
Pfctl-t table_name-T flush
Pfctl-t table_name-T show
Pfctl-t table_name-T zero

Filter scan detection software
Block in quick proto tcp all flags SF/SFRA
Block in quick proto tcp all flags SFUP/SFRAU
Block in quick proto tcp all flags FPU/SFRAUP
Block in quick proto tcp all flags/SFRA
Block in quick proto tcp all flags F/SFRA
Block in quick proto tcp all flags U/SFRAU
Block in quick proto tcp all flags P

If the firewall and Proxy Server are not on the same host
Proxy Server: 192.168.13.250
No rdr on rl0 proto tcp from 192.168.13.250 to any port 80
Rdr on rl0 proto tcp from 192.168.20./ 24 to any port 80-> 192.168.13.250 port 3128