Building the Network You Need with OpenBSD's PF: BSDCan, Ottawa May 6th, 2009
Prev |  | Next

# Queueing for a DMZ: rules part 2

    pass in on $ext_if proto { tcp, udp } from any to $nameservers \
         port domain queue ext_udp
    pass in on $int_if proto { tcp, udp } from $localnet to $nameservers \
         port domain
    pass out on $dmz_if proto { tcp, udp } from any to $nameservers port \
         domain queue ext_dmz_udp
    pass out on $dmz_if proto { tcp, udp } from $localnet to $nameservers \
         port domain queue dmz_udp
    pass in on $ext_if proto tcp from any to $webserver port $webports \
         queue ext_web
    pass in on $int_if proto tcp from $localnet to $webserver port $webports
    pass out on $dmz_if proto tcp from any to $webserver port $webports \
         queue ext_dmz_web
    pass out on $dmz_if proto tcp from $localnet to $webserver port $webports \
         queue dmz_web
    pass in log on $ext_if proto tcp from any to $mailserver port smtp
    pass in log on $ext_if proto tcp from $localnet to $mailserver port smtp
    pass in log on $int_if proto tcp from $localnet to $mailserver port $email
    pass out log on $dmz_if proto tcp from any to $mailserver port smtp \
         queue ext_mail
    pass in on $dmz_if from $mailserver to any port smtp queue dmz_mail
    pass out log on $ext_if proto tcp from $mailserver to any port smtp \
         queue ext_dmz_mailt