ipfw.conf 9.19 KB
Newer Older
1 2
{# collect interfaces list (with / without captive portal enabled) #}
{% set cp_interface_list = [] %}
3 4
{% set no_cp_interface_list = [] %}
{% if helpers.exists('OPNsense.captiveportal.zones.zone') %}
5 6
{% for intf_key,interface in interfaces.iteritems()%}
{%      set is_cp=[] %}
7 8 9 10 11
{%      for cp_item in  helpers.toList('OPNsense.captiveportal.zones.zone') %}
{%        for cp_intf in cp_item.interfaces.split(',') %}
{%          if intf_key == cp_intf %}
{%              if cp_item.enabled|default('0') == '1' %}
{%                  do cp_interface_list.append({'zone':cp_item.description, 'zoneid':cp_item.zoneid,'if':interface.if}) %}
12 13
{%                  do is_cp.append(1) %}
{%              endif %}
14
{%          endif %}
15
{%        endfor %}
16
{%      endfor %}
17 18 19
{%      if not is_cp%}
{%              do no_cp_interface_list.append(interface) %}
{%      endif %}
20
{% endfor %}
21 22 23 24
{% else %}
{%      for intf_key,interface in interfaces.iteritems() %}
{%              do no_cp_interface_list.append(interface) %}
{%      endfor %}
25
{% endif %}
26

27 28 29 30 31
#======================================================================================
# flush ruleset
#======================================================================================
flush

32 33 34
#======================================================================================
# define dummynet pipes
#======================================================================================
35
{% if helpers.exists('OPNsense.TrafficShaper.pipes.pipe') %}
36
{% for pipe in helpers.toList('OPNsense.TrafficShaper.pipes.pipe') %}
37 38 39 40
pipe {{ pipe.number }} config bw {{ pipe.bandwidth }}{{ pipe.bandwidthMetric }}/s{% if pipe.burst %} burst {{ pipe.burst }}{% endif %}{%
 if pipe.queue %} queue {{ pipe.queue }}{%
 if pipe.queueMetric != 'slots' %}{{pipe.queueMetric}}{% endif %}{% endif
 %}{% if pipe.mask != 'none' %} mask {{ pipe.mask }} 0xffffffff {% endif %}
41

42
{% endfor %}
43 44
{% endif %}

45 46 47 48 49
#======================================================================================
# define dummynet queues
#======================================================================================
{% if helpers.exists('OPNsense.TrafficShaper.queues.queue') %}
{% for queue in helpers.toList('OPNsense.TrafficShaper.queues.queue') %}
50 51 52
{%    if helpers.getUUIDtag(queue.pipe) in ['pipe'] %}
queue {{ queue.number }} config pipe {{ helpers.getUUID(queue.pipe).number }} weight {{ queue.weight }}
{%    endif %}
53 54 55 56
{% endfor %}
{% endif %}


57 58 59 60 61 62 63 64 65 66 67 68 69 70
#======================================================================================
# general purpose rules 1...1000
#======================================================================================
add 100 allow pfsync from any to any
add 110 allow carp from any to any
# layer 2: pass ARP
add 120 pass layer2 mac-type arp,rarp
# OPNsense requires for WPA
add 130 pass layer2 mac-type 0x888e,0x88c7
# PPP Over Ethernet Session Stage/Discovery Stage
add 140 pass layer2 mac-type 0x8863,0x8864
# layer 2: block anything else non-IP(v4/v6)
add 150 deny layer2 not mac-type ip,ipv6

71
# allow traffic send from localhost
72
add 200 skipto 60000 ipv6 from ::1 to any
73
add 201 skipto 60000 ipv4 from 127.0.0.0/8 to any
74 75
add 202 skipto 60000 ipv6 from any to ::1
add 203 skipto 60000 ipv4 from any to 127.0.0.0/8
76

77 78 79 80
#======================================================================================
# Allow traffic to this hosts static ip's
#======================================================================================
{% for intf_key,interface in interfaces.iteritems() %}
81
{% if intf_key != "wan" and interface.ipaddr != "dhcp" and interface.ipaddr|default("") != "" %}
82 83 84 85 86
add {{loop.index  + 1000}} skipto 60000 udp from any to {{ interface.ipaddr }} dst-port 53 keep-state
add {{loop.index  + 1000}} skipto 60000 ip from any to { 255.255.255.255 or {{interface.ipaddr}} } in
add {{loop.index  + 1000}} skipto 60000 ip from { 255.255.255.255 or {{interface.ipaddr}} } to any out
add {{loop.index  + 1000}} skipto 60000 icmp from { 255.255.255.255 or {{interface.ipaddr}} } to any out icmptypes 0
add {{loop.index  + 1000}} skipto 60000 icmp from any to { 255.255.255.255 or {{interface.ipaddr}} } in icmptypes 8
87 88 89
{% endif %}
{% endfor %}

90
{% for item in cp_interface_list %}
91
#===================================================================================
92
# zone {{item.zone}} ({{item.zoneid}}) / {{item.if}} configuration
93
#===================================================================================
94 95 96
{# authenticated clients #}
add {{3000 + item.zoneid|int }}  skipto {{10001 + item.zoneid|int * 1000  }} ip from table({{item.zoneid|int}}) to any via {{item.if}}
add {{3000 + item.zoneid|int }}  skipto {{10001 + item.zoneid|int * 1000  }} ip from any to table({{item.zoneid|int}}) via {{item.if}}
97 98 99
{% endfor %}


100 101 102 103
#======================================================================================
# redirect non-authenticated clients to captive portal @ local port 8000 + zoneid
#======================================================================================
{% for item in cp_interface_list %}
104 105 106
add {{5000 + item.zoneid|int }} fwd 127.0.0.1,{{  item.zoneid|int + 8000 }} tcp from any to any dst-port 443 in via {{item.if}}
add {{5000 + item.zoneid|int }} allow ip from any to any dst-port 443 via {{item.if}}
add {{5000 + item.zoneid|int }} fwd 127.0.0.1,{{  item.zoneid|int + 9000 }} tcp from any to any dst-port 80 in via {{item.if}}
107 108 109 110 111 112 113 114
add {{5000 + item.zoneid|int }} allow ip from any to any dst-port 80 via {{item.if}}
{% endfor %}


#======================================================================================
# accept traffic from all interfaces not used by captive portal
#======================================================================================
# let the responses from the captive portal web server back out
115 116 117
add 6000 skipto 60000 tcp from any to any out
# forward unauthorized traffic from captiveportal interfaces to block rule
{% for item in cp_interface_list %}
Ad Schellevis's avatar
Ad Schellevis committed
118
add {{6001 + loop.index }} skipto 65534 all from any to any via {{item.if}}
119 120
{% endfor %}
# send all the rest to the traffic shaper rules
121
add 6199 skipto 60000 all from any to any
122

123

124 125 126
#======================================================================================
# setup zone accounting section
#======================================================================================
127 128 129 130 131
{% for item in cp_interface_list %}
# zone {{item.zone}} ({{item.zoneid}})
add {{ (item.zoneid|int * 1000) + 10001 }} count ip from any to any via {{item.if}}
add {{ (item.zoneid|int * 1000) + 10998 }} skipto 30000 all from any to any via {{item.if}}
add {{ (item.zoneid|int * 1000) + 10999 }} deny all from any to any not via {{item.if}}
132
{% endfor %}
133 134 135 136 137 138


#======================================================================================
# setup accounting section, first rule is counting all CP traffic
#======================================================================================
add 30000 set 0 count ip from any to any
139 140 141


#======================================================================================
142
# traffic shaping section, authorized traffic
143 144
#======================================================================================
add 60000 return via any
145 146

{% if helpers.exists('OPNsense.TrafficShaper.rules.rule') %}
147
{% for rule in helpers.toList('OPNsense.TrafficShaper.rules.rule', 'sequence') %}
148
{%    if helpers.getUUIDtag(rule.target) in ['pipe','queue'] %}
149
{%        if helpers.getNodeByTag('interfaces.'+rule.interface) %}
150 151 152 153
{%            if helpers.getUUID(rule.target).enabled|default('0') == '1' %}
{%                if helpers.getUUIDtag(rule.target) == 'pipe' or
                     helpers.getUUID(helpers.getUUID(rule.target).pipe).enabled|default('0') == '1'
%}
154 155
{%                       if rule.interface2 and helpers.getNodeByTag('interfaces.'+rule.interface2) %}
{#  2 interface defined, use both to match packets (2 rules)  #}
156
add {{loop.index  + 60000}} {{ helpers.getUUIDtag(rule.target) }} {{
157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173
    helpers.getUUID(rule.target).number }} {{ rule.proto }} from {{ rule.source }} to {{rule.destination
    }} src-port  {{ rule.src_port }} dst-port {{ rule.dst_port }} {{rule.direction}} recv {{
    helpers.getNodeByTag('interfaces.'+rule.interface).if }} xmit {{helpers.getNodeByTag('interfaces.'+rule.interface2).if
    }}
add {{loop.index  + 60000}} {{ helpers.getUUIDtag(rule.target) }} {{
    helpers.getUUID(rule.target).number }} {{ rule.proto }} from {{ rule.source }} to {{rule.destination
    }} src-port  {{ rule.src_port }} dst-port {{ rule.dst_port }} {{rule.direction}} xmit {{
    helpers.getNodeByTag('interfaces.'+rule.interface).if }} recv {{helpers.getNodeByTag('interfaces.'+rule.interface2).if
    }}
{%                       else %}
{#  normal, single interface situation  #}
add {{loop.index  + 60000}} {{ helpers.getUUIDtag(rule.target) }} {{
    helpers.getUUID(rule.target).number }} {{ rule.proto }} from {{ rule.source }} to {{rule.destination
    }} src-port  {{ rule.src_port }} dst-port {{ rule.dst_port }} {{rule.direction}} via {{
    helpers.getNodeByTag('interfaces.'+rule.interface).if
    }}
{%                       endif %}
174 175
{%                   endif %}
{%            endif %}
176
{%        endif %}
177
{%    endif %}
178 179 180 181
{% endfor %}
{% endif %}

# pass authorized
182
add 65533 pass ip from any to any
183 184 185

# block all unmatched
add 65534 deny all from any to any