aboutsummaryrefslogtreecommitdiffstats
path: root/roles/pf/templates/pf.conf.j2
blob: 1b51fe720d947e45f0562954b536544d5b28105a (plain) (blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
# managed by Ansible
{% import 'macros.j2' as macros with context %}

# common configuration
set block-policy drop
set loginterface egress
set skip on { lo wg0 }
block all

# force ssh if not present below
pass in quick on egress proto tcp to port {{ ansible_port }}

# host services
{% for service in __services %}
pass in quick on egress proto {{ service["protocol"] }} to port {{ service["port"] }}
{% endfor %}

# wireguard
pass in on egress inet proto udp from any to any port 50000
pass out quick on egress inet from (wg0:network) nat-to (egress:0)

# output network
pass out quick inet
pass in proto { icmp, icmp6 } all
remember that computers suck.