head	1.4;
access;
symbols
	RELENG_8_4:1.4.0.2
	RELENG_9_1_0_RELEASE:1.2.4.1.4.2
	RELENG_9_1:1.2.4.1.0.4
	RELENG_9_1_BP:1.2.4.1
	RELENG_8_3_0_RELEASE:1.2.2.1.8.1
	RELENG_8_3:1.2.2.1.0.8
	RELENG_8_3_BP:1.2.2.1
	RELENG_9_0_0_RELEASE:1.2.4.1.2.1
	RELENG_9_0:1.2.4.1.0.2
	RELENG_9_0_BP:1.2.4.1
	RELENG_9:1.2.0.4
	RELENG_9_BP:1.2
	RELENG_7_4_0_RELEASE:1.1.12.1.10.1
	RELENG_8_2_0_RELEASE:1.2.2.1.6.1
	RELENG_7_4:1.1.12.1.0.10
	RELENG_7_4_BP:1.1.12.1
	RELENG_8_2:1.2.2.1.0.6
	RELENG_8_2_BP:1.2.2.1
	RELENG_8_1_0_RELEASE:1.2.2.1.4.1
	RELENG_8_1:1.2.2.1.0.4
	RELENG_8_1_BP:1.2.2.1
	RELENG_7_3_0_RELEASE:1.1.12.1.8.1
	RELENG_7_3:1.1.12.1.0.8
	RELENG_7_3_BP:1.1.12.1
	RELENG_8_0_0_RELEASE:1.2.2.1.2.1
	RELENG_8_0:1.2.2.1.0.2
	RELENG_8_0_BP:1.2.2.1
	RELENG_8:1.2.0.2
	RELENG_8_BP:1.2
	RELENG_7_2_0_RELEASE:1.1.12.1.6.1
	RELENG_7_2:1.1.12.1.0.6
	RELENG_7_2_BP:1.1.12.1
	RELENG_7_1_0_RELEASE:1.1.12.1.4.1
	RELENG_6_4_0_RELEASE:1.1.16.1
	RELENG_7_1:1.1.12.1.0.4
	RELENG_7_1_BP:1.1.12.1
	RELENG_6_4:1.1.0.16
	RELENG_6_4_BP:1.1
	RELENG_7_0_0_RELEASE:1.1.12.1
	RELENG_6_3_0_RELEASE:1.1
	RELENG_7_0:1.1.12.1.0.2
	RELENG_7_0_BP:1.1.12.1
	RELENG_6_3:1.1.0.14
	RELENG_6_3_BP:1.1
	RELENG_7:1.1.0.12
	RELENG_7_BP:1.1
	RELENG_6_2_0_RELEASE:1.1
	RELENG_6_2:1.1.0.10
	RELENG_6_2_BP:1.1
	RELENG_5_5_0_RELEASE:1.1.2.1
	RELENG_5_5:1.1.2.1.0.6
	RELENG_5_5_BP:1.1.2.1
	RELENG_6_1_0_RELEASE:1.1
	RELENG_6_1:1.1.0.8
	RELENG_6_1_BP:1.1
	RELENG_6_0_0_RELEASE:1.1
	RELENG_6_0:1.1.0.6
	RELENG_6_0_BP:1.1
	RELENG_6:1.1.0.4
	RELENG_6_BP:1.1
	RELENG_5_4_0_RELEASE:1.1.2.1
	RELENG_5_4:1.1.2.1.0.4
	RELENG_5_4_BP:1.1.2.1
	RELENG_5_3_0_RELEASE:1.1.2.1
	RELENG_5_3:1.1.2.1.0.2
	RELENG_5_3_BP:1.1.2.1
	RELENG_5:1.1.0.2;
locks; strict;
comment	@# @;


1.4
date	2012.11.17.01.50.32;	author svnexp;	state Exp;
branches
	1.4.2.1;
next	1.3;

1.3
date	2012.06.28.03.30.17;	author rpaulo;	state Exp;
branches;
next	1.2;

1.2
date	2007.11.11.01.16.51;	author mlaier;	state Exp;
branches
	1.2.2.1
	1.2.4.1;
next	1.1;

1.1
date	2004.09.14.01.07.18;	author mlaier;	state Exp;
branches
	1.1.2.1
	1.1.4.1
	1.1.12.1
	1.1.16.1;
next	;

1.4.2.1
date	2012.11.17.01.50.32;	author svnexp;	state dead;
branches;
next	1.4.2.2;

1.4.2.2
date	2013.03.28.13.03.42;	author svnexp;	state Exp;
branches;
next	;

1.2.2.1
date	2009.08.03.08.13.06;	author kensmith;	state Exp;
branches
	1.2.2.1.2.1
	1.2.2.1.4.1
	1.2.2.1.6.1
	1.2.2.1.8.1;
next	1.2.2.2;

1.2.2.2
date	2012.11.17.10.36.19;	author svnexp;	state Exp;
branches;
next	;

1.2.2.1.2.1
date	2009.10.25.01.10.29;	author kensmith;	state Exp;
branches;
next	;

1.2.2.1.4.1
date	2010.06.14.02.09.06;	author kensmith;	state Exp;
branches;
next	;

1.2.2.1.6.1
date	2010.12.21.17.09.25;	author kensmith;	state Exp;
branches;
next	;

1.2.2.1.8.1
date	2012.03.03.06.15.13;	author kensmith;	state Exp;
branches;
next	1.2.2.1.8.2;

1.2.2.1.8.2
date	2012.11.17.08.24.59;	author svnexp;	state Exp;
branches;
next	;

1.2.4.1
date	2011.09.23.00.51.37;	author kensmith;	state Exp;
branches
	1.2.4.1.2.1
	1.2.4.1.4.1;
next	1.2.4.2;

1.2.4.2
date	2012.11.17.11.36.35;	author svnexp;	state Exp;
branches;
next	;

1.2.4.1.2.1
date	2011.11.11.04.20.22;	author kensmith;	state Exp;
branches;
next	1.2.4.1.2.2;

1.2.4.1.2.2
date	2012.11.17.08.36.34;	author svnexp;	state Exp;
branches;
next	;

1.2.4.1.4.1
date	2012.08.05.23.54.33;	author kensmith;	state Exp;
branches;
next	1.2.4.1.4.2;

1.2.4.1.4.2
date	2012.11.17.08.47.24;	author svnexp;	state Exp;
branches;
next	;

1.1.2.1
date	2004.09.17.18.27.15;	author mlaier;	state Exp;
branches;
next	;

1.1.4.1
date	2012.11.17.07.41.34;	author svnexp;	state Exp;
branches;
next	;

1.1.12.1
date	2007.11.11.02.16.00;	author mlaier;	state Exp;
branches
	1.1.12.1.4.1
	1.1.12.1.6.1
	1.1.12.1.8.1
	1.1.12.1.10.1;
next	1.1.12.2;

1.1.12.2
date	2012.11.17.08.03.54;	author svnexp;	state Exp;
branches;
next	;

1.1.12.1.4.1
date	2008.11.25.02.59.29;	author kensmith;	state Exp;
branches;
next	;

1.1.12.1.6.1
date	2009.04.15.03.14.26;	author kensmith;	state Exp;
branches;
next	;

1.1.12.1.8.1
date	2010.02.10.00.26.20;	author kensmith;	state Exp;
branches;
next	;

1.1.12.1.10.1
date	2010.12.21.17.10.29;	author kensmith;	state Exp;
branches;
next	1.1.12.1.10.2;

1.1.12.1.10.2
date	2012.11.17.08.16.57;	author svnexp;	state Exp;
branches;
next	;

1.1.16.1
date	2008.10.02.02.57.24;	author kensmith;	state Exp;
branches;
next	;


desc
@@


1.4
log
@Switching exporter and resync
@
text
@# $FreeBSD: head/share/examples/pf/faq-example1 237681 2012-06-28 03:30:17Z rpaulo $
# $OpenBSD: faq-example1,v 1.5 2006/10/07 04:48:01 mcbride Exp $

#
# Firewall for Home or Small Office
# http://www.openbsd.org/faq/pf/example1.html
#


# macros
ext_if="fxp0"
int_if="xl0"

tcp_services="{ 22, 113 }"
icmp_types="echoreq"

comp3="192.168.0.3"

# options
set block-policy return
set loginterface $ext_if

set skip on lo

# scrub
scrub in

# nat/rdr
nat on $ext_if inet from !($ext_if) -> ($ext_if:0)
nat-anchor "ftp-proxy/*"
rdr-anchor "ftp-proxy/*"

rdr pass on $int_if proto tcp to port ftp -> 127.0.0.1 port 8021
rdr on $ext_if proto tcp from any to any port 80 -> $comp3

# filter rules
block in

pass out

anchor "ftp-proxy/*"
antispoof quick for { lo $int_if }

pass in on $ext_if inet proto tcp from any to ($ext_if) port $tcp_services

pass in on $ext_if inet proto tcp from any to $comp3 port 80 \
    synproxy state

pass in inet proto icmp all icmp-type $icmp_types

pass quick on $int_if no state
@


1.4.2.1
log
@file faq-example1 was added on branch RELENG_8_4 on 2013-03-28 13:03:42 +0000
@
text
@d1 51
@


1.4.2.2
log
@## SVN ## Exported commit - http://svnweb.freebsd.org/changeset/base/248810
## SVN ## CVS IS DEPRECATED: http://wiki.freebsd.org/CvsIsDeprecated
@
text
@a0 51
# $FreeBSD: releng/8.4/share/examples/pf/faq-example1 173536 2007-11-11 01:16:51Z mlaier $
# $OpenBSD: faq-example1,v 1.5 2006/10/07 04:48:01 mcbride Exp $

#
# Firewall for Home or Small Office
# http://www.openbsd.org/faq/pf/example1.html
#


# macros
ext_if="fxp0"
int_if="xl0"

tcp_services="{ 22, 113 }"
icmp_types="echoreq"

comp3="192.168.0.3"

# options
set block-policy return
set loginterface $ext_if

set skip on lo

# scrub
scrub in

# nat/rdr
nat on $ext_if from !($ext_if) -> ($ext_if:0)
nat-anchor "ftp-proxy/*"
rdr-anchor "ftp-proxy/*"

rdr pass on $int_if proto tcp to port ftp -> 127.0.0.1 port 8021
rdr on $ext_if proto tcp from any to any port 80 -> $comp3

# filter rules
block in

pass out

anchor "ftp-proxy/*"
antispoof quick for { lo $int_if }

pass in on $ext_if inet proto tcp from any to ($ext_if) port $tcp_services

pass in on $ext_if inet proto tcp from any to $comp3 port 80 \
    synproxy state

pass in inet proto icmp all icmp-type $icmp_types

pass quick on $int_if no state
@


1.3
log
@SVN rev 237681 on 2012-06-28 03:30:17Z by rpaulo

Add the 'inet' keyword after the nat rule to avoid interfering with
IPv6.
@
text
@d1 1
a1 1
# $FreeBSD$
@


1.2
log
@Update pf examples from OpenBSD to catch up with new stateful defaults and
other syntax changes.  Move pf.conf from /etc to examples, too.
@
text
@d29 1
a29 1
nat on $ext_if from !($ext_if) -> ($ext_if:0)
@


1.2.4.1
log
@SVN rev 225736 on 2011-09-23 00:51:37Z by kensmith

Copy head to stable/9 as part of 9.0-RELEASE release cycle.

Approved by:	re (implicit)
@
text
@@


1.2.4.2
log
@## SVN ##
## SVN ## Exported commit - http://svnweb.freebsd.org/changeset/base/ 242902
## SVN ## CVS IS DEPRECATED: http://wiki.freebsd.org/CvsIsDeprecated
## SVN ##
## SVN ## ------------------------------------------------------------------------
## SVN ## r242902 | dteske | 2012-11-11 23:29:45 +0000 (Sun, 11 Nov 2012) | 10 lines
## SVN ##
## SVN ## Fix a regression introduced by SVN r211417 that saw the breakage of a feature
## SVN ## documented in usr.sbin/sysinstall/help/shortcuts.hlp (reproduced below):
## SVN ##
## SVN ## If /usr/sbin/sysinstall is linked to another filename, say
## SVN ## `/usr/local/bin/configPackages', then the basename will be used
## SVN ## as an implicit command name.
## SVN ##
## SVN ## Reviewed by:	adrian (co-mentor)
## SVN ## Approved by:	adrian (co-mentor)
## SVN ##
## SVN ## ------------------------------------------------------------------------
## SVN ##
@
text
@d1 1
a1 1
# $FreeBSD: stable/9/share/examples/pf/faq-example1 173536 2007-11-11 01:16:51Z mlaier $
@


1.2.4.1.4.1
log
@SVN rev 239080 on 2012-08-05 23:54:33Z by kensmith

Copy stable/9 to releng/9.1 as part of the 9.1-RELEASE release process.

Approved by:	re (implicit)
@
text
@@


1.2.4.1.4.2
log
@Switch importer
@
text
@d1 1
a1 1
# $FreeBSD: releng/9.1/share/examples/pf/faq-example1 173536 2007-11-11 01:16:51Z mlaier $
@


1.2.4.1.2.1
log
@SVN rev 227445 on 2011-11-11 04:20:22Z by kensmith

Copy stable/9 to releng/9.0 as part of the FreeBSD 9.0-RELEASE release
cycle.

Approved by:	re (implicit)
@
text
@@


1.2.4.1.2.2
log
@Switch importer
@
text
@d1 1
a1 1
# $FreeBSD: releng/9.0/share/examples/pf/faq-example1 173536 2007-11-11 01:16:51Z mlaier $
@


1.2.2.1
log
@SVN rev 196045 on 2009-08-03 08:13:06Z by kensmith

Copy head to stable/8 as part of 8.0 Release cycle.

Approved by:	re (Implicit)
@
text
@@


1.2.2.2
log
@## SVN ##
## SVN ## Exported commit - http://svnweb.freebsd.org/changeset/base/ 242909
## SVN ## CVS IS DEPRECATED: http://wiki.freebsd.org/CvsIsDeprecated
## SVN ##
## SVN ## ------------------------------------------------------------------------
## SVN ## r242909 | dim | 2012-11-12 07:47:19 +0000 (Mon, 12 Nov 2012) | 20 lines
## SVN ##
## SVN ## MFC r242625:
## SVN ##
## SVN ## Remove duplicate const specifiers in many drivers (I hope I got all of
## SVN ## them, please let me know if not).  Most of these are of the form:
## SVN ##
## SVN ## static const struct bzzt_type {
## SVN ##       [...list of members...]
## SVN ## } const bzzt_devs[] = {
## SVN ##       [...list of initializers...]
## SVN ## };
## SVN ##
## SVN ## The second const is unnecessary, as arrays cannot be modified anyway,
## SVN ## and if the elements are const, the whole thing is const automatically
## SVN ## (e.g. it is placed in .rodata).
## SVN ##
## SVN ## I have verified this does not change the binary output of a full kernel
## SVN ## build (except for build timestamps embedded in the object files).
## SVN ##
## SVN ## Reviewed by:	yongari, marius
## SVN ##
## SVN ## ------------------------------------------------------------------------
## SVN ##
@
text
@d1 1
a1 1
# $FreeBSD: stable/8/share/examples/pf/faq-example1 173536 2007-11-11 01:16:51Z mlaier $
@


1.2.2.1.8.1
log
@SVN rev 232438 on 2012-03-03 06:15:13Z by kensmith

Copy stable/8 to releng/8.3 as part of 8.3-RELEASE release cycle.

Approved by:	re (implicit)
@
text
@@


1.2.2.1.8.2
log
@Switch importer
@
text
@d1 1
a1 1
# $FreeBSD: releng/8.3/share/examples/pf/faq-example1 173536 2007-11-11 01:16:51Z mlaier $
@


1.2.2.1.6.1
log
@SVN rev 216617 on 2010-12-21 17:09:25Z by kensmith

Copy stable/8 to releng/8.2 in preparation for FreeBSD-8.2 release.

Approved by:	re (implicit)
@
text
@@


1.2.2.1.4.1
log
@SVN rev 209145 on 2010-06-14 02:09:06Z by kensmith

Copy stable/8 to releng/8.1 in preparation for 8.1-RC1.

Approved by:	re (implicit)
@
text
@@


1.2.2.1.2.1
log
@SVN rev 198460 on 2009-10-25 01:10:29Z by kensmith

Copy stable/8 to releng/8.0 as part of 8.0-RELEASE release procedure.

Approved by:	re (implicit)
@
text
@@


1.1
log
@Bring in some examples (and create space for future work here):
- Add OpenBSD example rulesets as advertised in etc/pf.conf and pf.conf(5)
- Tweak the pointer to fit the FreeBSD default location share/examples/pf
- Account for the new directory in BSD.usr.dist (no hier(7) change required
  as share/examples is an opaque item there).

Obtained from:	OpenBSD
Reminded by:	Thomas T. Veldhouse
PR:		docs/71691
MFC after:	2 days
@
text
@d2 1
a2 1
# $OpenBSD: faq-example1,v 1.2 2003/08/06 16:04:45 henning Exp $
d11 2
a12 2
int_if = "fxp0"
ext_if = "ep0"
d14 4
a17 2
tcp_services = "{ 22, 113 }"
icmp_types = "echoreq"
a18 2
priv_nets = "{ 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8 }"
        
d23 2
d26 1
a26 1
scrub in all
d29 6
a34 3
nat on $ext_if from $int_if:network to any -> ($ext_if)
rdr on $int_if proto tcp from any to any port 21 -> 127.0.0.1 \
   port 8021
d37 1
a37 1
block all
d39 1
a39 1
pass quick on lo0 all
d41 2
a42 2
block drop in  quick on $ext_if from $priv_nets to any
block drop out quick on $ext_if from any to $priv_nets
d44 1
a44 2
pass in on $ext_if inet proto tcp from any to ($ext_if) \
   port $tcp_services flags S/SA keep state
d46 2
a47 1
pass in inet proto icmp all icmp-type $icmp_types keep state
d49 1
a49 2
pass in  on $int_if from $int_if:network to any keep state
pass out on $int_if from any to $int_if:network keep state
d51 1
a51 2
pass out on $ext_if proto tcp all modulate state flags S/SA
pass out on $ext_if proto { udp, icmp } all keep state
@


1.1.4.1
log
@Switch importer
@
text
@d1 1
a1 1
# $FreeBSD: stable/6/share/examples/pf/faq-example1 135184 2004-09-14 01:07:19Z mlaier $
@


1.1.16.1
log
@SVN rev 183531 on 2008-10-02 02:57:24Z by kensmith

Create releng/6.4 from stable/6 in preparation for 6.4-RC1.

Approved by:	re (implicit)
@
text
@@


1.1.12.1
log
@MFC:
  Update pf examples from OpenBSD to catch up with new stateful defaults and
  other syntax changes.  Move pf.conf from /etc to examples, too.

Approved by:	re (kensmith)
@
text
@d2 1
a2 1
# $OpenBSD: faq-example1,v 1.5 2006/10/07 04:48:01 mcbride Exp $
d11 2
a12 2
ext_if="fxp0"
int_if="xl0"
d14 2
a15 4
tcp_services="{ 22, 113 }"
icmp_types="echoreq"

comp3="192.168.0.3"
d17 2
a22 2
set skip on lo

d24 1
a24 1
scrub in
d27 3
a29 6
nat on $ext_if from !($ext_if) -> ($ext_if:0)
nat-anchor "ftp-proxy/*"
rdr-anchor "ftp-proxy/*"

rdr pass on $int_if proto tcp to port ftp -> 127.0.0.1 port 8021
rdr on $ext_if proto tcp from any to any port 80 -> $comp3
d32 1
a32 1
block in
d34 1
a34 1
pass out
d36 2
a37 2
anchor "ftp-proxy/*"
antispoof quick for { lo $int_if }
d39 2
a40 1
pass in on $ext_if inet proto tcp from any to ($ext_if) port $tcp_services
d42 1
a42 2
pass in on $ext_if inet proto tcp from any to $comp3 port 80 \
    synproxy state
d44 2
a45 1
pass in inet proto icmp all icmp-type $icmp_types
d47 2
a48 1
pass quick on $int_if no state
@


1.1.12.2
log
@Switch importer
@
text
@d1 1
a1 1
# $FreeBSD: stable/7/share/examples/pf/faq-example1 173538 2007-11-11 02:16:00Z mlaier $
@


1.1.12.1.10.1
log
@SVN rev 216618 on 2010-12-21 17:10:29Z by kensmith

Copy stable/7 to releng/7.4 in preparation for FreeBSD-7.4 release.

Approved by:	re (implicit)
@
text
@@


1.1.12.1.10.2
log
@Switch importer
@
text
@d1 1
a1 1
# $FreeBSD: releng/7.4/share/examples/pf/faq-example1 173538 2007-11-11 02:16:00Z mlaier $
@


1.1.12.1.8.1
log
@SVN rev 203736 on 2010-02-10 00:26:20Z by kensmith

Copy stable/7 to releng/7.3 as part of the 7.3-RELEASE process.

Approved by:	re (implicit)
@
text
@@


1.1.12.1.6.1
log
@SVN rev 191087 on 2009-04-15 03:14:26Z by kensmith

Create releng/7.2 from stable/7 in preparation for 7.2-RELEASE.

Approved by:	re (implicit)
@
text
@@


1.1.12.1.4.1
log
@SVN rev 185281 on 2008-11-25 02:59:29Z by kensmith

Create releng/7.1 in preparation for moving into RC phase of 7.1 release
cycle.

Approved by:	re (implicit)
@
text
@@


1.1.2.1
log
@MFC pf examples:
  Bring in some examples (and create space for future work here):
   - Add OpenBSD example rulesets as advertised in etc/pf.conf and
     pf.conf(5)
   - Tweak the pointer to fit the FreeBSD default location share/examples/pf
   - Account for the new directory in BSD.usr.dist (no hier(7) change
     required as share/examples is an opaque item there).

  Obtained from:  OpenBSD
  Reminded by:    Thomas T. Veldhouse
  PR:             docs/71691

Approved by:	re (scottl)
@
text
@@

