Posts filed under 'FreeBSD'

Pertama-tama konfigurasi kernel anda agar support pf :

#Packet Filter Options

device pf
device pflog
device pfsync

#Enabling ALTQ

options ALTQ
options ALTQ_CBQ # Class Bases Queuing (CBQ)
options ALTQ_RED # Random Early Detection (RED)
options ALTQ_RIO # RED In/Out
options ALTQ_HFSC # Hierarchical Packet Scheduler (HFSC)
options ALTQ_PRIQ # Priority Queuing (PRIQ)
options ALTQ_NOPCC # Required for SMP build

Berikut konfigurasi yg saya implementasikan pada box FreeBsd saya, buat para admin jaringan yang menggunakan box FreeBsd silahkan anda kopas. Tapi sesuaikan dengan kondisi box sampeyan..

### macros

# internal and external interfaces (ketikan ‘ifconfig’ buat lihat interface)

int_if = “vr0″

ext_if = “rl0″

# Port Yang Boleh Diakses dari Luar Box silahkan sesuaikan

tcp_services = “{ 80, 110, 25, 53, 113, 21}”

udp_services = “{ 53, 1194 }”

# ping requests

icmp_types = “echoreq”

# Private Network, Yg Mau di Blok Traffiknya

priv_nets = “{ 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8 }”

### options


set block-policy return

set loginterface $ext_if

set skip on lo0

### Scrub

scrub in all

### nat/rdr

# NAT traffic dari Internal Ke External

nat on $ext_if from $int_if:network to any -> ($ext_if)

# Port Redirector untuk Transparent Proxy & Transparent FTP

rdr on $int_if proto tcp from any to any port 21 -> 127.0.0.1 port 8021

rdr on $int_if proto tcp from any to any port 80 -> 127.0.0.1 port 3128

### filter rules

block all

# Blok Traffik Dari Luar Yang Pake IP Private


block drop in quick on $ext_if from $priv_nets to any

# Blok Trafik dari Luar ke Internal

block drop out quick on $ext_if from any to $priv_nets

# Perbolehkan Akses ke TCP port tertentu

pass in on $ext_if inet proto tcp from any to ($ext_if) \

port $tcp_services flags S/SA keep state

# Perbolehkan Akses ke UDP port tertentu

pass in on $ext_if proto udp to any port $udp_services keep state

# Perbolehkan Akses FTP


pass in on $ext_if inet proto tcp from port 20 to ($ext_if) \

user proxy flags S/SA keep state

# Ping Reply OK

pass in inet proto icmp all icmp-type $icmp_types keep state

# Perbolehkan Traffik dari Internal ke Internal Interface

pass in on $int_if from $int_if:network to any keep state

pass out on $int_if from any to $int_if:network keep state

# Perbolehkan Traffik keluar melalui External Interface

pass out on $ext_if proto tcp all modulate state flags S/SA


pass out on $ext_if proto { udp, icmp } all keep state

Untuk ngecek nat dan konfigurasi anda silahkan gunakan perintah

# pfctl -Fn -Nf /etc/pf.conf

flush rules

# pfctl -f /etc/pf.conf

Dan untuk me-restart pf anda gunakan perintah

# pfctl -NORf /etc/pf.conf

Biar auto start, masukkan script berikut di rc.conf anda :

pf_enable="YES" # Enable PF (load module if required)
pf_rules="/etc/pf.conf" # rules definition file for pf
pf_flags="" # additional flags for pfctl startup
pflog_enable="YES" # start pflogd(8)
pflog_logfile="/var/log/pflog" # where pflogd should store the logfile
pflog_flags="" # additional flags for pflogd startup
gateway_enable="YES" # Enable as LAN gateway