Configuración del cortafuegos PF

PF (filtro de paquetes) es el firewall predeterminado en FreeBSD, conocido por su sintaxis limpia y potentes funciones.

Habilitando PF

Agregar a /etc/rc.conf:

pf_enable="YES"
pf_rules="/etc/pf.conf"
pflog_enable="YES"

Configuración básica

Cree /etc/pf.conf:

# Macros
ext_if = "vtnet0"
tcp_services = "{ ssh, http, https }"

# Options
set block-policy drop
set skip on lo0

# Normalisation
scrub in all

# Default deny
block all

# Allow outbound
pass out quick on $ext_if

# Allow inbound services
pass in on $ext_if proto tcp to port $tcp_services

# Allow ICMP ping
pass in inet proto icmp icmp-type echoreq

Comandos útiles

# Load rules
pfctl -f /etc/pf.conf

# Check syntax
pfctl -nf /etc/pf.conf

# Show current rules
pfctl -sr

# Show state table
pfctl -ss

# View logs
tcpdump -n -e -ttt -i pflog0

Limitación de velocidad

Protéjase contra ataques de fuerza bruta:

# Limit SSH connections
pass in on $ext_if proto tcp to port ssh \
    flags S/SA keep state \
    (max-src-conn 5, max-src-conn-rate 3/60)