Administrace komentářů

# -- sysinstall generated deltas -- # Fri Aug 14 18:31:53 2009
# Created: Fri Aug 14 18:31:53 2009
# Enable network daemons for user convenience.
# Please make all changes to this file, not to /etc/defaults/rc.conf.
# This file now contains just the overrides from /etc/defaults/rc.conf.
defaultrouter="x.x.x.254"
hostname="jmeno1.firma.pl"
ifconfig_bge0="inet x.x.x.58  netmask 255.255.255.0"
ifconfig_bge1="inet x.x.x.59  netmask 255.255.255.0"
inetd_enable="NO"
keymap="us.iso"
sshd_enable="YES"
# Packet Filter
pf_enable="YES"
pf_rules="/etc/pf.conf"
pf_flags=""
pflog_enable="YES"
pflog_logfile="/var/log/pflog"
pflog_flags=""
gateway_enable="NO"
spamd_enable="YES"
clamav_clamd_enable="YES"
clamav_freshclam_enable="YES"
amavisd_enable="YES"
sendmail_enable="NO"
sendmail_submit_enable="NO"
sendmail_outbound_enable="NO"
sendmail_msp_queue_enable="NO"
sendmail_flags="-bd -q3m"
courier_authdaemond_enable="YES"
courier_imap_pop3d_ssl_enable="YES"
courier_imap_imapd_enable="YES"
courier_imap_imapd_ssl_enable="YES"
postfix_enable="YES"
mysql_enable="YES"
mysql_dbdir="/var/db/mysql"
apache22_enable="YES"

## Macros
SYN_ONLY="S/FSRA"
EXT_NIC0="bge0"
EXT_NIC1="bge1"

# Your Internet IP goes in the EXT_IP variable
EXT_IP1="x.x.x.58"
EXT_IP2="x.x.x.59"


## TABLES 


## GLOBAL OPTIONS 


## TRAFFIC NORMALIZATION 
scrub in on $EXT_NIC0 all fragment reassemble
scrub out on $EXT_NIC0 all fragment reassemble random-id no-df
scrub in on $EXT_NIC1 all fragment reassemble
scrub out on $EXT_NIC1 all fragment reassemble random-id no-df

## QUEUEING RULES


## TRANSLATION RULES (NAT)


## FILTER RULES 

# Block everything (inbound AND outbound on ALL interfaces) by default (catch-all)
block all

# Default TCP policy
block return-rst in log on $EXT_NIC0 proto TCP all
block return-rst in log on $EXT_NIC1 proto TCP all
pass in log quick on $EXT_NIC0 proto TCP from any to $EXT_IP1 port 8086 flags $SYN_ONLY keep state
pass in log quick on $EXT_NIC1 proto TCP from any to $EXT_IP2 port 8086 flags $SYN_ONLY keep state
# pass in log quick on $EXT_NIC proto TCP from any to $EXT_IP port 113 flags $SYN_ONLY keep state
# pass in log quick on $EXT_NIC proto TCP from any to $EXT_IP port 110 flags $SYN_ONLY keep state
# pass in log quick on $EXT_NIC proto TCP from any to $EXT_IP port 143 flags $SYN_ONLY keep state
pass in log quick on $EXT_NIC0 proto TCP from any to $EXT_IP1 port 25 flags $SYN_ONLY keep state
pass in log quick on $EXT_NIC1 proto TCP from any to $EXT_IP2 port 25 flags $SYN_ONLY keep state
pass in log quick on $EXT_NIC0 proto TCP from any to $EXT_IP1 port 995 flags $SYN_ONLY keep state
pass in log quick on $EXT_NIC1 proto TCP from any to $EXT_IP2 port 995 flags $SYN_ONLY keep state
# SMTPS? pass in log quick on $EXT_NIC proto TCP from any to $EXT_IP port 465 flags $SYN_ONLY keep state
pass in log quick on $EXT_NIC0 proto TCP from any to $EXT_IP1 port 443 flags $SYN_ONLY keep state
pass in log quick on $EXT_NIC1 proto TCP from any to $EXT_IP2 port 443 flags $SYN_ONLY keep state
# MYSQL  pass in log quick on $EXT_NIC proto TCP from any to $EXT_IP port 3306 flags $SYN_ONLY keep state
# AMAVISD pass in log quick on $EXT_NIC proto TCP from any to $EXT_IP port 10024 flags $SYN_ONLY keep state
antispoof for $EXT_NIC0 inet
antispoof for $EXT_NIC1 inet

# Default UDP policy
block in log on $EXT_NIC0 proto udp all
block in log on $EXT_NIC1 proto udp all
   # It's rare to be hosting a service that requires UDP (unless you are hosting 
   # a dns server for example), so there typically won't be any entries here.

# Default ICMP policy
block in log on $EXT_NIC0 proto icmp all
   pass in log quick on $EXT_NIC0 proto icmp from any to $EXT_IP1 icmp-type 0 keep state
   pass in log quick on $EXT_NIC0 proto icmp from any to $EXT_IP1 icmp-type 8 keep state
block in log on $EXT_NIC1 proto icmp all
   pass in log quick on $EXT_NIC1 proto icmp from any to $EXT_IP2 icmp-type 0 keep state
   pass in log quick on $EXT_NIC1 proto icmp from any to $EXT_IP2 icmp-type 8 keep state
block out log on $EXT_NIC0 all
   pass out log quick on $EXT_NIC0 from $EXT_IP1 to any keep state
block out log on $EXT_NIC1 all
   pass out log quick on $EXT_NIC1 from $EXT_IP2 to any keep state   

# Allow the local interface to talk unrestricted
pass in quick on lo0 all
pass out quick on lo0 all

::1			localhost localhost.firma.pl
127.0.0.1		localhost localhost.firma.pl
x.x.x.58		jmeno1.firma.pl jmeno1
x.x.x.58		jmeno1.firma.pl.

# nema tady byt jeste toto?
x.x.x.59		jmeno2.firma.sk jmeno2
x.x.x.59		jmeno2.firma.sk.

bge0: flags=8843< UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST > metric 0 mtu 1500
	options=9b< RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM >
	ether aa:aa:aa:aa:aa:32
	inet x.x.x.58 netmask 0xffffff00 broadcast x.x.x.255
	media: Ethernet autoselect (100baseTX < full-duplex >)
	status: active
bge1: flags=8843< UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST > metric 0 mtu 1500
	options=9b< RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM >
	ether aa:aa:aa:aa:aa:33
	inet x.x.x.59 netmask 0xffffff00 broadcast x.x.x.255
	media: Ethernet autoselect (100baseTX < full-duplex >)
	status: active
lo0: flags=8049< UP,LOOPBACK,RUNNING,MULTICAST > metric 0 mtu 16384
	inet6 fe80::1%lo0 prefixlen 64 scopeid 0x3 
	inet6 ::1 prefixlen 128 
	inet 127.0.0.1 netmask 0xff000000 
pflog0: flags=141< UP,RUNNING,PROMISC > metric 0 mtu 33160