talexander/machine_setup
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Improve firewall config.

Browse Source
This commit is contained in:
Tom Alexander 2023-06-19 22:16:09 -04:00
parent f2526cc768
commit 2e4c2c3f9b
Signed by: talexander
GPG Key ID: D3A179C9A53C0EDE
1 changed files with 2 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
ansible/roles/firewall/files/mrmanager_pf.conf
View File

@ -18,7 +18,7 @@ set skip on lo
# redirections # redirections
nat pass on lagg0 inet from $jail_nat_v4 to $not_jail_nat_v4 -> (lagg0) nat pass on lagg0 inet from $jail_nat_v4 to $not_jail_nat_v4 -> (lagg0)
nat pass on $not_ext_if inet from $jail_nat_v4 to 10.215.1.1 port 53 -> ($ext_if) nat pass on $not_ext_if inet from $jail_nat_v4 to 10.215.1.1 port 53 -> ($ext_if)
rdr pass on $not_ext_if proto {tcp, udp} from any to 10.215.1.1 port 53 -> 1.1.1.1 port 53 rdr pass on $not_ext_if proto {tcp, udp} from $jail_nat_v4 to 10.215.1.1 port 53 -> 1.1.1.1 port 53
rdr pass on $ext_if inet proto tcp from $not_jail_nat_v4 to any port 6443 -> 10.215.1.204 port 6443 rdr pass on $ext_if inet proto tcp from $not_jail_nat_v4 to any port 6443 -> 10.215.1.204 port 6443
rdr pass on jail_nat inet proto tcp from $jail_nat_v4 to any port 6443 -> 10.215.1.204 port 6443 rdr pass on jail_nat inet proto tcp from $jail_nat_v4 to any port 6443 -> 10.215.1.204 port 6443
@ -30,8 +30,7 @@ rdr pass on jail_nat inet proto tcp from $jail_nat_v4 to $not_jail_nat_v4 port 6
# nat pass on $not_ext_if proto {tcp, udp} from $not_jail_nat_v4 to 10.215.1.210 port 65099 -> (jail_nat) # nat pass on $not_ext_if proto {tcp, udp} from $not_jail_nat_v4 to 10.215.1.210 port 65099 -> (jail_nat)
# nat pass on $not_ext_if proto {tcp, udp} from $jail_nat_v4 to 10.215.1.210 port 65099 -> (lagg0) # nat pass on $not_ext_if proto {tcp, udp} from $jail_nat_v4 to 10.215.1.210 port 65099 -> (lagg0)
rdr pass on $ext_if inet proto {tcp, udp} from $not_jail_nat_v4 to $not_jail_nat_v4 port 53 -> 10.215.1.211 port 53 rdr pass inet proto {tcp, udp} from any to ($ext_if) port 53 -> 10.215.1.211 port 53
rdr pass on jail_nat inet proto {tcp, udp} from $jail_nat_v4 to $not_jail_nat_v4 port 53 -> 10.215.1.211 port 53
# filtering # filtering