diff options
| author | Sadeep Madurange <sadeep@asciimx.com> | 2026-09-18 18:18:00 +0800 |
|---|---|---|
| committer | Sadeep Madurange <sadeep@asciimx.com> | 2026-09-18 18:30:03 +0800 |
| commit | e1209d926631e495ee29137fd62c51e1dd324663 (patch) | |
| tree | 5a198ad2a39df4fc9e3b1bab54705d5ba94cc3b5 | |
| parent | 55420821afc7ffb24dc9a9c5b1e58e712aa36c37 (diff) | |
| download | lex-e1209d926631e495ee29137fd62c51e1dd324663.tar.gz | |
PF config.
| -rw-r--r-- | conf/pf.conf | 27 | ||||
| -rw-r--r-- | conf/ssh-config (renamed from ssh-config) | 0 |
2 files changed, 27 insertions, 0 deletions
diff --git a/conf/pf.conf b/conf/pf.conf new file mode 100644 index 0000000..ee387f5 --- /dev/null +++ b/conf/pf.conf @@ -0,0 +1,27 @@ +# $OpenBSD: pf.conf,v 1.55 2017/12/03 20:40:04 sthen Exp $ +# +# See pf.conf(5) and /etc/examples/pf.conf + +net_if="localnet" +vps="xxx.xx.xxx.xxx" +home_net="xxx.xxx.x.x/xx" +router="xxx.xxx.x.x" + +set skip on lo +block all + +# Block all outgoing traffic to local network +block out on $net_if to $home_net + +# Allow outbound to router for DNS +pass out on $net_if proto { tcp, udp } to $router port domain + +# Allow outbound SSH to VPS +pass out on $net_if inet proto tcp from ($net_if) to $vps port ssh + +# Allow NTP and HTTPS outbound to the internet; exclude local network +pass out on $net_if proto udp to ! $home_net port ntp +pass out on $net_if proto tcp to ! $home_net port https + +# Allow inbound SSH from local network management hosts +pass in on $net_if inet proto tcp from $home_net to ($net_if) port ssh diff --git a/ssh-config b/conf/ssh-config index cd70866..cd70866 100644 --- a/ssh-config +++ b/conf/ssh-config |