mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity
3f83bd4e1f
pfsense/conf.default/config.xml
pierrepomes 473d0ff02f Add patch from lietu (Janne Enberg). Ticket #136 
1) Multiple NAT rules can be assigned the same filter rule
-> Fixed, added assigned-nat-rule-id to filter rules to keep track of the assignment

2) when removing the link (i.e. switching to "pass" or "none", the linked rule isn't deleted (should it be? probably yes)
-> Fixed, when a NAT rule's association is removed, the filter rule is deleted. Added a "create new associated filter rule" option to the
dropdown if there is none selected.

3) The destination IP and port of linked rules can be edited in firewall_rules_edit.php and shouldn't be. Source should be editable but not
destination, since that should strictly be tied to the NAT rule.
-> Fixed, you cannot edit the destination for the filter rules that are linked to NAT rules, this has been disabled both by JavaScript and
PHP.

4) If you edit the source in a linked firewall rule, it gets overwritten when you edit the NAT rule. The NAT rule should never touch the
firewall rule source after the rule exists.
-> Fixed, previously the old rule was deleted and a new one created, now it only updates the old rule and doesn't touch the source.

Also added crosslinking from the NAT rule to the filter rule and back, so you can jump to edit the filter rule from the NAT rule and
vice-versa.
2009-12-12 15:57:19 -05:00

796 lines
18 KiB
XML
Raw Blame History

<?xml version="1.0"?>
<!-- pfSense default system configuration -->
<pfsense>
<version>5.8</version>
<lastchange></lastchange>
<theme>pfsense_ng</theme>
<sysctl>
<item>
<desc>Set the ephemeral port range to be lower.</desc>
<tunable>net.inet.ip.portrange.first</tunable>
<value>default</value>
</item>
<item>
<desc>Drop packets to closed TCP ports without returning a RST</desc>
<tunable>net.inet.tcp.blackhole</tunable>
<value>default</value>
</item>
<item>
<desc>Do not send ICMP port unreachable messages for closed UDP ports</desc>
<tunable>net.inet.udp.blackhole</tunable>
<value>default</value>
</item>
<item>
<desc>Randomize the ID field in IP packets (default is 0: sequential IP IDs)</desc>
<tunable>net.inet.ip.random_id</tunable>
<value>default</value>
</item>
<item>
<desc>Drop SYN-FIN packets (breaks RFC1379, but nobody uses it anyway)</desc>
<tunable>net.inet.tcp.drop_synfin</tunable>
<value>default</value>
</item>
<item>
<desc>Enable sending IPv4 redirects</desc>
<tunable>net.inet.ip.redirect</tunable>
<value>default</value>
</item>
<item>
<desc>Enable sending IPv6 redirects</desc>
<tunable>net.inet6.ip6.redirect</tunable>
<value>default</value>
</item>
<item>
<desc>Generate SYN cookies for outbound SYN-ACK packets</desc>
<tunable>net.inet.tcp.syncookies</tunable>
<value>default</value>
</item>
<item>
<desc>Maximum incoming/outgoing TCP datagram size (receive)</desc>
<tunable>net.inet.tcp.recvspace</tunable>
<value>default</value>
</item>
<item>
<desc>Maximum incoming/outgoing TCP datagram size (send)</desc>
<tunable>net.inet.tcp.sendspace</tunable>
<value>default</value>
</item>
<item>
<desc>IP Fastforwarding</desc>
<tunable>net.inet.ip.fastforwarding</tunable>
<value>default</value>
</item>
<item>
<desc>Do not delay ACK to try and piggyback it onto a data packet</desc>
<tunable>net.inet.tcp.delayed_ack</tunable>
<value>default</value>
</item>
<item>
<desc>Maximum outgoing UDP datagram size</desc>
<tunable>net.inet.udp.maxdgram</tunable>
<value>default</value>
</item>
<item>
<desc>Handling of non-IP packets which are not passed to pfil (see if_bridge(4))</desc>
<tunable>net.link.bridge.pfil_onlyip</tunable>
<value>default</value>
</item>
<item>
<desc>Set to 0 to disable filtering on the incoming and outgoing member interfaces.</desc>
<tunable>net.link.bridge.pfil_member</tunable>
<value>default</value>
</item>
<item>
<desc>Set to 1 to enable filtering on the bridge interface</desc>
<tunable>net.link.bridge.pfil_bridge</tunable>
<value>default</value>
</item>
<item>
<desc>Allow unprivileged access to tap(4) device nodes</desc>
<tunable>net.link.tap.user_open</tunable>
<value>default</value>
</item>
<item>
<desc>Verbosity of the rndtest driver (0: do not display results on console)</desc>
<tunable>kern.rndtest.verbose</tunable>
<value>default</value>
</item>
<item>
<desc>Randomize PID's (see src/sys/kern/kern_fork.c: sysctl_kern_randompid())</desc>
<tunable>kern.randompid</tunable>
<value>default</value>
</item>
<item>
<desc>Maximum size of the IP input queue</desc>
<tunable>net.inet.ip.intr_queue_maxlen</tunable>
<value>default</value>
</item>
<item>
<desc>Disable CTRL+ALT+Delete reboot from keyboard.</desc>
<tunable>hw.syscons.kbd_reboot</tunable>
<value>default</value>
</item>
<item>
<desc>Enable TCP Inflight mode</desc>
<tunable>net.inet.tcp.inflight.enable</tunable>
<value>default</value>
</item>
<item>
<desc>Enable TCP extended debugging</desc>
<tunable>net.inet.tcp.log_debug</tunable>
<value>default</value>
</item>
<item>
<desc>Set ICMP Limits</desc>
<tunable>net.inet.icmp.icmplim</tunable>
<value>default</value>
</item>
<item>
<desc>TCP Offload Engine</desc>
<tunable>net.inet.tcp.tso</tunable>
<value>default</value>
</item>
<item>
<desc>TCP Offload Engine - BCE</desc>
<tunable>hw.bce.tso_enable</tunable>
<value>default</value>
</item>
</sysctl>
<system>
<optimization>normal</optimization>
<hostname>pfSense</hostname>
<domain>local</domain>
<dnsserver></dnsserver>
<dnsallowoverride/>
<group>
<name>all</name>
<description>All Users</description>
<scope>system</scope>
<gid>1998</gid>
<member>0</member>
</group>
<group>
<name>admins</name>
<description>System Administrators</description>
<scope>system</scope>
<gid>1999</gid>
<member>0</member>
<priv>page-all</priv>
</group>
<user>
<name>admin</name>
<fullname>System Administrator</fullname>
<scope>system</scope>
<groupname>admins</groupname>
<password>$1$dSJImFph$GvZ7.1UbuWu.Yb8etC0re.</password>
<uid>0</uid>
<priv>user-shell-access</priv>
</user>
<nextuid>2000</nextuid>
<nextgid>2000</nextgid>
<timezone>Etc/UTC</timezone>
<time-update-interval>300</time-update-interval>
<timeservers>0.pfsense.pool.ntp.org</timeservers>
<webgui>
<protocol>https</protocol>
</webgui>
<disablenatreflection>yes</disablenatreflection>
<!-- <disableconsolemenu/> -->
<!-- <disablefirmwarecheck/> -->
<!-- <shellcmd></shellcmd> -->
<!-- <earlyshellcmd></earlyshellcmd> -->
<!-- <harddiskstandby></harddiskstandby> -->
</system>
<interfaces>
<wan>
<if>vr1</if>
<mtu></mtu>
<ipaddr>dhcp</ipaddr>
<!-- *or* ipv4-address *or* 'pppoe' *or* 'pptp' *or* 'bigpond' -->
<subnet></subnet>
<gateway></gateway>
<blockpriv/>
<blockbogons/>
<dhcphostname></dhcphostname>
<media></media>
<mediaopt></mediaopt>
<bandwidth>100</bandwidth>
<bandwidthtype>Mb</bandwidthtype>
<!--
<wireless>
*see below (opt[n])*
</wireless>
-->
</wan>
<lan>
<if>vr0</if>
<ipaddr>192.168.1.1</ipaddr>
<subnet>24</subnet>
<media></media>
<mediaopt></mediaopt>
<bandwidth>100</bandwidth>
<bandwidthtype>Mb</bandwidthtype>
<!--
<wireless>
*see below (opt[n])*
</wireless>
-->
</lan>
<!--
<opt[n]>
<enable/>
<descr></descr>
<if></if>
<ipaddr></ipaddr>
<subnet></subnet>
<media></media>
<mediaopt></mediaopt>
<bridge>lan|wan|opt[n]</bridge>
<wireless>
<mode>hostap *or* bss *or* ibss</mode>
<ssid></ssid>
<channel></channel>
<wep>
<enable/>
<key>
<txkey/>
<value></value>
</key>
</wep>
</wireless>
</opt[n]>
-->
</interfaces>
<!--
<vlans>
<vlan>
<tag></tag>
<if></if>
<descr></descr>
</vlan>
</vlans>
-->
<staticroutes>
<!--
<route>
<interface>lan|opt[n]|pptp</interface>
<network>xxx.xxx.xxx.xxx/xx</network>
<gateway>xxx.xxx.xxx.xxx</gateway>
<descr></descr>
</route>
-->
</staticroutes>
<pppoe>
<username></username>
<password></password>
<provider></provider>
<!--
<ondemand/>
<timeout></timeout>
-->
</pppoe>
<pptp>
<username></username>
<password></password>
<local></local>
<subnet></subnet>
<remote></remote>
<!--
<ondemand/>
<timeout></timeout>
-->
</pptp>
<dhcpd>
<lan>
<enable/>
<range>
<from>192.168.1.100</from>
<to>192.168.1.199</to>
</range>
<!--
<winsserver>xxx.xxx.xxx.xxx</winsserver>
<defaultleasetime></defaultleasetime>
<maxleasetime></maxleasetime>
<gateway>xxx.xxx.xxx.xxx</gateway>
<domain></domain>
<dnsserver></dnsserver>
<ntpserver>xxx.xxx.xxx.xxx</ntpserver>
<next-server></next-server>
<filename></filename>
-->
</lan>
<!--
<opt[n]>
...
</opt[n]>
-->
<!--
<staticmap>
<mac>xx:xx:xx:xx:xx:xx</mac>
<ipaddr>xxx.xxx.xxx.xxx</ipaddr>
<descr></descr>
</staticmap>
-->
</dhcpd>
<pptpd>
<mode><!-- off *or* server *or* redir --></mode>
<redir></redir>
<localip></localip>
<remoteip></remoteip>
<!-- <accounting/> -->
<!--
<user>
<name></name>
<password></password>
</user>
-->
</pptpd>
<ovpn>
<!--
<server>
<enable/>
<ca_cert></ca_cert>
<srv_cert></srv_cert>
<srv_key></srv_key>
<dh_param></dh_param>
<verb></verb>
<tun_iface></tun_iface>
<port></port>
<bind_iface></bind_iface>
<cli2cli/>
<maxcli></maxcli>
<prefix></prefix>
<ipblock></ipblock>
<crypto></crypto>
<dupcn/>
<psh_options>
<redir></redir>
<redir_loc></redir_loc>
<rte_delay></rte_delay>
<ping></ping>
<pingrst></pingrst>
<pingexit></pingexit>
<inact></inact>
</psh_options>
</server>
<client>
<tunnel></tunnel>
<ca_cert></ca_cert>
<cli_cert></cli_cert>
<cli_key></cli_key>
<type></type>
<tunnel>
<if></if>
<proto></proto>
<cport></cport>
<saddr></saddr>
<sport></sport>
<crypto></crypto>
</tunnel>
</client>
-->
</ovpn>
<dnsmasq>
<enable/>
<!--
<hosts>
<host></host>
<domain></domain>
<ip></ip>
<descr></descr>
</hosts>
-->
</dnsmasq>
<snmpd>
<!-- <enable/> -->
<syslocation></syslocation>
<syscontact></syscontact>
<rocommunity>public</rocommunity>
</snmpd>
<diag>
<ipv6nat>
<!-- <enable/> -->
<ipaddr></ipaddr>
</ipv6nat>
</diag>
<bridge>
<!-- <filteringbridge/> -->
</bridge>
<syslog>
<!--
<reverse/>
<enable/>
<remoteserver>xxx.xxx.xxx.xxx</remoteserver>
<filter/>
<dhcp/>
<system/>
<nologdefaultblock/>
-->
</syslog>
<!--
<captiveportal>
<enable/>
<interface>lan|opt[n]</interface>
<idletimeout>minutes</idletimeout>
<timeout>minutes</timeout>
<page>
<htmltext></htmltext>
<errtext></errtext>
</page>
<httpslogin/>
<httpsname></httpsname>
<certificate></certificate>
<private-key></private-key>
<redirurl></redirurl>
<radiusip></radiusip>
<radiusport></radiusport>
<radiuskey></radiuskey>
<nomacfilter/>
</captiveportal>
-->
<nat>
<ipsecpassthru>
<enable/>
</ipsecpassthru>
<!--
<rule>
<interface></interface>
<external-address></external-address>
<protocol></protocol>
<external-port></external-port>
<target></target>
<local-port></local-port>
<descr></descr>
<associated-filter-rule-id></associated-filter-rule-id>
</rule>
-->
<!--
<onetoone>
<interface></interface>
<external>xxx.xxx.xxx.xxx</external>
<internal>xxx.xxx.xxx.xxx</internal>
<subnet></subnet>
<descr></descr>
</onetoone>
-->
<!--
<advancedoutbound>
<enable/>
<rule>
<interface></interface>
<source>
<network>xxx.xxx.xxx.xxx/xx</network>
</source>
<destination>
<not/>
<any/>
*or*
<network>xxx.xxx.xxx.xxx/xx</network>
</destination>
<target>xxx.xxx.xxx.xxx</target>
<descr></descr>
</rule>
</advancedoutbound>
-->
<!--
<servernat>
<ipaddr></ipaddr>
<descr></descr>
</servernat>
-->
</nat>
<filter>
<!-- <tcpidletimeout></tcpidletimeout> -->
<rule>
<type>pass</type>
<descr>Default allow LAN to any rule</descr>
<interface>lan</interface>
<source>
<network>lan</network>
</source>
<destination>
<any/>
</destination>
<associated-nat-rule-id></associated-nat-rule-id>
</rule>
<!-- rule syntax:
<rule>
<disabled/>
<id>[0-9]*</id>
<type>pass|block|reject</type>
<descr>...</descr>
<interface>lan|opt[n]|wan|pptp</interface>
<protocol>tcp|udp|tcp/udp|...</protocol>
<icmptype></icmptype>
<source>
<not/>
<address>xxx.xxx.xxx.xxx(/xx) or alias</address>
*or*
<network>lan|opt[n]|pptp</network>
*or*
<any/>
<port>a[-b]</port>
</source>
<destination>
*same as for source*
</destination>
<frags/>
<log/>
</rule>
-->
</filter>
<shaper>
<!-- <enable/> -->
<!-- <schedulertype>hfsc</schedulertype> -->
<!-- rule syntax:
<rule>
<disabled/>
<descr></descr>
<targetpipe>number (zero based)</targetpipe>
*or*
<targetqueue>number (zero based)</targetqueue>
<interface>lan|wan|opt[n]|pptp</interface>
<protocol>tcp|udp</protocol>
<direction>in|out</direction>
<source>
<not/>
<address>xxx.xxx.xxx.xxx(/xx)</address>
*or*
<network>lan|opt[n]|pptp</network>
*or*
<any/>
<port>a[-b]</port>
</source>
<destination>
*same as for source*
</destination>
<iplen>from[-to]</iplen>
<iptos>(!)lowdelay,throughput,reliability,mincost,congestion</iptos>
<tcpflags>(!)fin,syn,rst,psh,ack,urg</tcpflags>
</rule>
<pipe>
<descr></descr>
<bandwidth></bandwidth>
<delay></delay>
<mask>source|destination</mask>
</pipe>
<queue>
<descr></descr>
<targetpipe>number (zero based)</targetpipe>
<weight></weight>
<mask>source|destination</mask>
</queue>
-->
</shaper>
<ipsec>
<preferredoldsa/>
<!-- <enable/> -->
<!-- syntax:
<tunnel>
<disabled/>
<auto/>
<descr></descr>
<interface>lan|wan|opt[n]</interface>
<local-subnet>
<address>xxx.xxx.xxx.xxx(/xx)</address>
*or*
<network>lan|opt[n]</network>
</local-subnet>
<remote-subnet>xxx.xxx.xxx.xxx/xx</remote-subnet>
<remote-gateway></remote-gateway>
<p1>
<mode></mode>
<myident>
<myaddress/>
*or*
<address>xxx.xxx.xxx.xxx</address>
*or*
<fqdn>the.fq.dn</fqdn>
</myident>
<encryption-algorithm></encryption-algorithm>
<hash-algorithm></hash-algorithm>
<dhgroup></dhgroup>
<lifetime></lifetime>
<pre-shared-key></pre-shared-key>
</p1>
<p2>
<protocol></protocol>
<encryption-algorithm-option></encryption-algorithm-option>
<hash-algorithm-option></hash-algorithm-option>
<pfsgroup></pfsgroup>
<lifetime></lifetime>
</p2>
</tunnel>
<mobileclients>
<enable/>
<p1>
<mode></mode>
<myident>
<myaddress/>
*or*
<address>xxx.xxx.xxx.xxx</address>
*or*
<fqdn>the.fq.dn</fqdn>
</myident>
<encryption-algorithm></encryption-algorithm>
<hash-algorithm></hash-algorithm>
<dhgroup></dhgroup>
<lifetime></lifetime>
</p1>
<p2>
<protocol></protocol>
<encryption-algorithm-option></encryption-algorithm-option>
<hash-algorithm-option></hash-algorithm-option>
<pfsgroup></pfsgroup>
<lifetime></lifetime>
</p2>
</mobileclients>
<mobilekey>
<ident></ident>
<pre-shared-key></pre-shared-key>
</mobilekey>
-->
</ipsec>
<aliases>
<!--
<alias>
<name></name>
<address>xxx.xxx.xxx.xxx(/xx)</address>
<descr></descr>
</alias>
-->
</aliases>
<proxyarp>
<!--
<proxyarpnet>
<network>xxx.xxx.xxx.xxx/xx</network>
*or*
<range>
<from>xxx.xxx.xxx.xxx</from>
<to>xxx.xxx.xxx.xxx</to>
</range>
</proxyarpnet>
-->
</proxyarp>
<cron>
<item>
<minute>0</minute>
<hour>*</hour>
<mday>*</mday>
<month>*</month>
<wday>*</wday>
<who>root</who>
<command>/usr/bin/nice -n20 newsyslog</command>
</item>
<item>
<minute>1,31</minute>
<hour>0-5</hour>
<mday>*</mday>
<month>*</month>
<wday>*</wday>
<who>root</who>
<command>/usr/bin/nice -n20 adjkerntz -a</command>
</item>
<item>
<minute>1</minute>
<hour>3</hour>
<mday>1</mday>
<month>*</month>
<wday>*</wday>
<who>root</who>
<command>/usr/bin/nice -n20 /etc/rc.update_bogons.sh</command>
</item>
<item>
<minute>*/60</minute>
<hour>*</hour>
<mday>*</mday>
<month>*</month>
<wday>*</wday>
<who>root</who>
<command>/usr/bin/nice -n20 /usr/local/sbin/expiretable -v -t 3600 sshlockout</command>
</item>
<item>
<minute>1</minute>
<hour>1</hour>
<mday>*</mday>
<month>*</month>
<wday>*</wday>
<who>root</who>
<command>/usr/bin/nice -n20 /etc/rc.dyndns.update</command>
</item>
<item>
<minute>*/60</minute>
<hour>*</hour>
<mday>*</mday>
<month>*</month>
<wday>*</wday>
<who>root</who>
<command>/usr/bin/nice -n20 /usr/local/sbin/expiretable -v -t 3600 virusprot</command>
</item>
<item>
<minute>*/5</minute>
<hour>*</hour>
<mday>*</mday>
<month>*</month>
<wday>*</wday>
<who>root</who>
<command>/usr/bin/nice -n20 /usr/local/bin/checkreload.sh</command>
</item>
<item>
<minute>*/5</minute>
<hour>*</hour>
<mday>*</mday>
<month>*</month>
<wday>*</wday>
<who>root</who>
<command>/usr/bin/nice -n20 /etc/ping_hosts.sh</command>
</item>
</cron>
<wol>
<!--
<wolentry>
<interface>lan|opt[n]</interface>
<mac>xx:xx:xx:xx:xx:xx</mac>
<descr></descr>
</wolentry>
-->
</wol>
<rrd>
<enable/>
</rrd>
<load_balancer>
<monitor_type>
<name>ICMP</name>
<type>icmp</type>
<desc>ICMP</desc>
<options>
</options>
</monitor_type>
<monitor_type>
<name>TCP</name>
<type>tcp</type>
<desc>Generic TCP</desc>
<options>
</options>
</monitor_type>
<monitor_type>
<name>HTTP</name>
<type>http</type>
<desc>Generic HTTP</desc>
<options>
<path>/</path>
<host/>
<code>200</code>
</options>
</monitor_type>
<monitor_type>
<name>HTTPS</name>
<type>https</type>
<desc>Generic HTTPS</desc>
<options>
<path>/</path>
<host/>
<code>200</code>
</options>
</monitor_type>
<monitor_type>
<name>SMTP</name>
<type>send</type>
<desc>Generic SMTP</desc>
<options>
<send>EHLO nosuchhost</send>
<expect>250-</expect>
</options>
</monitor_type>
</load_balancer>
<widgets>
<sequence>system_information-container:col1:show,captive_portal_status-container:col1:close,carp_status-container:col1:close,cpu_graphs-container:col1:close,gateways-container:col1:close,gmirror_status-container:col1:close,installed_packages-container:col1:close,interface_statistics-container:col1:close,interfaces-container:col2:show,ipsec-container:col2:close,load_balancer_status-container:col2:close,log-container:col2:close,picture-container:col2:close,rss-container:col2:close,services_status-container:col2:close,traffic_graphs-container:col2:close</sequence>
</widgets>
</pfsense>
Reference in New Issue View Git Blame Copy Permalink