@TE:
Probiers hiermit. Musst natürlich dein Interface und deine Ports anpassen. Kannst dann auch deinen Webserver bspw. whitelisten.
PHP Code:
# Change the value to reflect your public interface. You can see this with ifconfig.
ext_if="em0"
# IP addresses that should override the firewall rules, such as your web server.
table <trusted_hosts> const { 8.8.8.8 8.8.4.4 }
# Ports used for services (SSH, MySQL)
service_ports="{ 22 3306 }"
# Ports used by Metin2
game_ports="{ 11002 13000 13002 }"
# Sets the interface for which PF should gather statistics such as bytes in/out and packets passed/blocked. Statistics can only be gathered for one interface at a time.
set loginterface $ext_if
#Skip all PF processing on interface. This can be useful on loopback interfaces where filtering, normalization, queueing, etc, are not required. This option can be used multiple times. By default this option is not set.
set skip on lo
# Table for abusive hosts
table <abusive_hosts> persist
# Block these bastards.
block in quick from <abusive_hosts>
# Schutz gegen gefälschte Adressen für Alle Interfaces aktivieren
block in quick from urpf-failed
# block anything coming from sources that we have no back routes for.
block in from no-route to any
# Rate limits, trial and error (service ports)
pass in on $ext_if proto tcp to any port $service_ports flags S/SA keep state \
(max-src-conn 30, max-src-conn-rate 5/15, overload <abusive_hosts> flush)
# Rate limits, trial and error (metin2 ports)
pass in on $ext_if proto {tcp,udp} to any port $game_ports flags S/SA keep state \
(max-src-conn 30, max-src-conn-rate 5/15, overload <abusive_hosts> flush)
# Allow whitelist override the firewall rules.
pass in quick from <trusted_hosts>
pass out all keep state
pass out on $ext_if all modulate state
# Allow ping in
pass in inet proto icmp all icmp-type echoreq
Servus,