UBinstaller/nas_preconf/configs/firewall2.conf

#!/bin/sh

# firewall command
FwCMD="/sbin/ipfw -q"
${FwCMD} -f flush

# Interfaces setup
LAN_IF="INTERNAL_INTERFACE"
WAN_IF="EXTERNAL_INTERFACE"
INTERNAL_IP="INT_ADDR"

ENABLE_VLANS="YES"

BRIDGE_NAME="bridge0"
VLAN_INTERFACE=${LAN_IF}
VLAN_COUNT="20"
VLAN_FROM="101"


case $ENABLE_VLANS in
YES)
#Bridge interface creation
/sbin/ifconfig bridge create
#casting VLANS and adding it to bridge
for i in $( jot ${VLAN_COUNT} ${VLAN_FROM} ); 
do 
echo "Creating vlan: ${VLAN_INTERFACE}.${i}"
/sbin/ifconfig ${VLAN_INTERFACE}.${i} create
/sbin/ifconfig ${VLAN_INTERFACE}.${i} up
echo "Adding vlan: ${VLAN_INTERFACE}.${i} to ${BRIDGE_NAME}"
/sbin/ifconfig ${BRIDGE_NAME} addm ${VLAN_INTERFACE}.${i} up
/sbin/ifconfig ${BRIDGE_NAME} private ${VLAN_INTERFACE}.${i}
done
USER_INTERFACE=${BRIDGE_NAME}
/sbin/ifconfig ${BRIDGE_NAME} maxaddr 9000
;;
NO)
USER_INTERFACE=${LAN_IF}
;;
esac

#manual MAC inherit
#/sbin/ifconfig ${USER_INTERFACE} ether a0:36:9f:c0:da:aa

#setting internal interface IP
/sbin/ifconfig ${USER_INTERFACE} ${INTERNAL_IP}
echo "Internal interface IP set to ${INTERNAL_IP}"



# Networks define
${FwCMD} table 2 add INTERNAL_NETWORK

#access for our site and other things
${FwCMD} add  62100 allow ip from table\(2\) to table\(17\)
${FwCMD} add  62100 allow ip from table\(17\) to table\(2\)

#NAT
${FwCMD} nat 1 config log if ${WAN_IF} reset same_ports
${FwCMD} add 6000 nat 1 ip from table\(2\) to not table\(9\) out xmit ${WAN_IF}
${FwCMD} add 6001 nat 1 ip from any to me in recv ${WAN_IF}


#Shape 
${FwCMD} add 12001 pipe tablearg ip from any to table\(4\) via ${USER_INTERFACE} out
${FwCMD} add 12000 pipe tablearg ip from table\(3\) to any via ${USER_INTERFACE} in


#security
${FwCMD} add 3 deny ip6 from any to any
${FwCMD} add 4 deny ip from table\(42\) to any
${FwCMD} add 4 deny ip from any to table\(42\)

# allow access to my http for all
${FwCMD} add  62000 allow tcp from any to me dst-port 80
${FwCMD} add  62000 allow tcp from me to any src-port 80


# default block policy
${FwCMD} add 65533 deny all from table\(2\) to any via ${USER_INTERFACE}
${FwCMD} add 65534 deny all from any to table\(2\) via ${USER_INTERFACE}
${FwCMD} add 65535 allow all from any to any

# netflow stats
/usr/local/bin/softflowd -i ${USER_INTERFACE} -n NF_HOST