diff options
| -rw-r--r-- | conf/pf.conf | 27 | ||||
| -rw-r--r-- | conf/ssh-config (renamed from ssh-config) | 0 |
2 files changed, 27 insertions, 0 deletions
diff --git a/conf/pf.conf b/conf/pf.conf new file mode 100644 index 0000000..ee387f5 --- /dev/null +++ b/conf/pf.conf @@ -0,0 +1,27 @@ +# $OpenBSD: pf.conf,v 1.55 2017/12/03 20:40:04 sthen Exp $ +# +# See pf.conf(5) and /etc/examples/pf.conf + +net_if="localnet" +vps="xxx.xx.xxx.xxx" +home_net="xxx.xxx.x.x/xx" +router="xxx.xxx.x.x" + +set skip on lo +block all + +# Block all outgoing traffic to local network +block out on $net_if to $home_net + +# Allow outbound to router for DNS +pass out on $net_if proto { tcp, udp } to $router port domain + +# Allow outbound SSH to VPS +pass out on $net_if inet proto tcp from ($net_if) to $vps port ssh + +# Allow NTP and HTTPS outbound to the internet; exclude local network +pass out on $net_if proto udp to ! $home_net port ntp +pass out on $net_if proto tcp to ! $home_net port https + +# Allow inbound SSH from local network management hosts +pass in on $net_if inet proto tcp from $home_net to ($net_if) port ssh diff --git a/ssh-config b/conf/ssh-config index cd70866..cd70866 100644 --- a/ssh-config +++ b/conf/ssh-config |