pf, OpenVPN, Squid and dummynet
Mazandar Wiki <[email protected]> Wed, 19 Jun 2019 09:07:39 +0000
| Newsgroups | gmane.os.openbsd.pf |
|---|---|
| Message-ID | <CANx7Mpdme5voGOXc4zt_6dW1RJFc1kGfQiP0yGsTsWeCtO0KqA@mail.gmail.com> |
--0000000000009c321b058ba7cbfa
Content-Type: text/plain; charset="UTF-8"
Hello.
I have to limit the Download/Upload speed of my OpenVPN users. I use Squid
(in transparent mode) for caching and logging their web traffic. I use
pfSense, which is based on FreeBSD 11.2-RELEASE.
pf, Squid and OpenVPN work great, the problem starts when dummynet comes
into play. dummynet just doesn't work when Squid is enabled, but it works
great when I disable squid. I've included my pf.conf. It seems OK to me,
but I am very new to pf.
I tried to pass the traffic to dummynet immediately after redirecting HTTP
and HTTPS traffics to ports 3128 and 3129 respectively, but it didn't work:
pass in quick on $OpenVPN inet proto tcp from any to any port 3128
tracker 1560924429 flags S/SA keep state dnpipe ( 1,2)
pass in quick on $OpenVPN inet proto tcp from any to any port 3129
tracker 1560924399 flags S/SA keep state dnpipe ( 1,2)
(changing the interface to $loopback also didn't help)
I also tried to pass packets destined for 127.0.0.1:3128 and 3129 to
dummynet with these rules, but it also didn't work (placing them in
appropriate section, before other rules).
pass in on $loopback inet proto tcp from any to any port 3128 dnpipe(1,2)
pass in on $loopback inet proto tcp from any to any port 3129 dnpipe(1,2)
I even changed the last rule of the file to this, but it also didn't work
either:
pass in quick on ovpns1 proto tcp from any to (ovpns1) port {3128,3129}
flags S/SA keep state dnpipe(1,2)
I tried a lot of other stuffs, none of them worked when squid was enabled.
Anyway, this is the whole pf.conf, generated by pfSense.
Could you please help me find the problem?
Thank you very much.
set limit table-entries 400000
set optimization normal
set limit states 97000
set limit src-nodes 97000
#System aliases
loopback = "{ lo0 }"
WAN = "{ em0 }"
LAN = "{ ovpns1 }"
OpenVPN = "{ openvpn }"
#SSH Lockout Table
table <sshguard> persist
#Snort tables
table <snort2c>
table <virusprot>
table <bogons> persist file "/etc/bogons"
table <vpn_networks> { 192.168.10.0/24 }
table <negate_networks> { 192.168.10.0/24 }
# User Aliases
# Gateways
GWWANGW = " route-to ( em0 172.19.20.1 ) "
GWWAN_DHCP = " route-to ( em0 172.19.20.1 ) "
GWLAN_VPNV4 = " route-to ( ovpns1 192.168.10.1 ) "
GWLAN_VPNV6 = " route-to ( ovpns1 192.168.10.1 ) "
set loginterface ovpns1
set skip on pfsync0
scrub on $WAN all fragment reassemble
scrub on $LAN all fragment reassemble
no nat proto carp
no rdr proto carp
nat-anchor "natearly/*"
nat-anchor "natrules/*"
# Outbound NAT rules (automatic)
# Subnets to NAT
tonatsubnets = "{ 127.0.0.0/8 ::1/128 192.168.10.0/24 }"
nat on $WAN inet from $tonatsubnets to any port 500 -> 172.19.20.101/32
static-port
nat on $WAN inet6 from $tonatsubnets to any port 500 -> (em0) static-port
nat on $WAN inet from $tonatsubnets to any -> 172.19.20.101/32 port
1024:65535
nat on $WAN inet6 from $tonatsubnets to any -> (em0) port 1024:65535
# Load balancing anchor
rdr-anchor "relayd/*"
# TFTP proxy
rdr-anchor "tftp-proxy/*"
# Setup Squid proxy redirect
rdr pass on ovpns1 proto tcp from any to !(ovpns1) port 80 -> 127.0.0.1
port 3128
rdr pass on ovpns1 proto tcp from any to !(ovpns1) port 443 -> 127.0.0.1
port 3129
# UPnPd rdr anchor
rdr-anchor "miniupnpd"
anchor "relayd/*"
anchor "openvpn/*"
anchor "ipsec/*"
# block IPv4 link-local. Per RFC 3927, link local "MUST NOT" be forwarded
by a routing device,
# and clients "MUST NOT" send such packets to a router. FreeBSD won't route
169.254./16, but
# route-to can override that, causing problems such as in redmine #2073
block in log quick from 169.254.0.0/16 to any tracker 1000000101 label
"Block IPv4 link-local"
block in log quick from any to 169.254.0.0/16 tracker 1000000102 label
"Block IPv4 link-local"
#---------------------------------------------------------------------------
# default deny rules
#---------------------------------------------------------------------------
block in log inet all tracker 1000000103 label "Default deny rule IPv4"
block out log inet all tracker 1000000104 label "Default deny rule IPv4"
block in log inet6 all tracker 1000000105 label "Default deny rule IPv6"
block out log inet6 all tracker 1000000106 label "Default deny rule IPv6"
# IPv6 ICMP is not auxilary, it is required for operation
# See man icmp6(4)
# 1 unreach Destination unreachable
# 2 toobig Packet too big
# 128 echoreq Echo service request
# 129 echorep Echo service reply
# 133 routersol Router solicitation
# 134 routeradv Router advertisement
# 135 neighbrsol Neighbor solicitation
# 136 neighbradv Neighbor advertisement
pass quick inet6 proto ipv6-icmp from any to any icmp6-type {1,2,135,136}
tracker 1000000107 keep state
# Allow only bare essential icmpv6 packets (NS, NA, and RA, echoreq,
echorep)
pass out quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10
icmp6-type {129,133,134,135,136} tracker 1000000108 keep state
pass out quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16
icmp6-type {129,133,134,135,136} tracker 1000000109 keep state
pass in quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type
{128,133,134,135,136} tracker 1000000110 keep state
pass in quick inet6 proto ipv6-icmp from ff02::/16 to fe80::/10 icmp6-type
{128,133,134,135,136} tracker 1000000111 keep state
pass in quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type
{128,133,134,135,136} tracker 1000000112 keep state
pass in quick inet6 proto ipv6-icmp from :: to ff02::/16 icmp6-type
{128,133,134,135,136} tracker 1000000113 keep state
# We use the mighty pf, we cannot be fooled.
block log quick inet proto { tcp, udp } from any port = 0 to any tracker
1000000114 label "Block traffic from port 0"
block log quick inet proto { tcp, udp } from any to any port = 0 tracker
1000000115 label "Block traffic to port 0"
block log quick inet6 proto { tcp, udp } from any port = 0 to any tracker
1000000116 label "Block traffic from port 0"
block log quick inet6 proto { tcp, udp } from any to any port = 0 tracker
1000000117 label "Block traffic to port 0"
# Snort package
block log quick from <snort2c> to any tracker 1000000118 label "Block
snort2c hosts"
block log quick from any to <snort2c> tracker 1000000119 label "Block
snort2c hosts"
# SSH lockout
block in log quick proto tcp from <sshguard> to (self) port 22 tracker
1000000301 label "sshguard"
# webConfigurator lockout
block in log quick proto tcp from <sshguard> to (self) port 443 tracker
1000000351 label "GUI Lockout"
block in log quick from <virusprot> to any tracker 1000000400 label
"virusprot overload table"
pass in quick on { em0 } proto tcp from any to { 172.19.20.101 } port {
8003 8002 } tracker 1000000551 keep state(sloppy)
pass out quick on { em0 } proto tcp from any to any flags any tracker
1000000552 keep state(sloppy)
# allow our DHCP client out to the WAN
pass in quick on $WAN proto udp from any port = 67 to any port = 68
tracker 1000000561 label "allow dhcp client out WAN"
pass out quick on $WAN proto udp from any port = 68 to any port = 67
tracker 1000000562 label "allow dhcp client out WAN"
# Not installing DHCP server firewall rules for WAN which is configured for
DHCP.
antispoof log for $WAN tracker 1000001570
antispoof log for $LAN tracker 1000002620
# loopback
pass in on $loopback inet all tracker 1000003711 label "pass IPv4 loopback"
pass out on $loopback inet all tracker 1000003712 label "pass IPv4
loopback"
pass in on $loopback inet6 all tracker 1000003713 label "pass IPv6
loopback"
pass out on $loopback inet6 all tracker 1000003714 label "pass IPv6
loopback"
# let out anything from the firewall host itself and decrypted IPsec traffic
pass out inet all keep state allow-opts tracker 1000003715 label "let out
anything IPv4 from firewall host itself"
pass out inet6 all keep state allow-opts tracker 1000003716 label "let out
anything IPv6 from firewall host itself"
pass out route-to ( em0 172.19.20.1 ) from 172.19.20.101 to !172.19.20.0/24
tracker 1000003811 keep state allow-opts label "let out anything from
firewall host itself"
pass out route-to ( ovpns1 192.168.10.1 ) from 192.168.10.1 to !
192.168.10.0/24 tracker 1000003812 keep state allow-opts label "let out
anything from firewall host itself"
# make sure the user cannot lock himself out of the webConfigurator or SSH
pass in quick on ovpns1 proto tcp from any to (ovpns1) port { 443 80 22 }
tracker 10000 keep state label "anti-lockout rule"
# User-defined rules follow
anchor "userrules/*"
# array key "enc0" does not exist for "" in array: {WAN LAN OpenVPN } label
"USER_RULE"
# array key "l2tp" does not exist for "" in array: {WAN LAN OpenVPN } label
"USER_RULE"
pass in quick on $OpenVPN inet proto udp from any to any port 53
tracker 1560852911 keep state label "USER_RULE"
pass in quick on $OpenVPN inet proto tcp from any to any port 53
tracker 1560852890 flags S/SA keep state label "USER_RULE"
pass in quick on $OpenVPN inet proto tcp from any to any port 3128
tracker 1560924429 flags S/SA keep state dnpipe ( 1,2) label "USER_RULE"
pass in quick on $OpenVPN inet proto tcp from any to any port 3129
tracker 1560924399 flags S/SA keep state dnpipe ( 1,2) label "USER_RULE"
block in quick on $OpenVPN inet proto tcp from any to any tracker
1560924366 flags S/SA label "USER_RULE"
pass in quick on $WAN reply-to ( em0 172.19.20.1 ) inet proto tcp from
any to any tracker 1560337356 flags S/SA keep state label "USER_RULE"
pass in quick on $WAN reply-to ( em0 172.19.20.1 ) inet proto udp from
any to any port 1194 tracker 1559381581 keep state label "USER_RULE: Allow
OpenVPN to this firewall1"
# VPN Rules
anchor "tftp-proxy/*"
# Setup squid pass rules for proxy
pass in quick on ovpns1 proto tcp from any to (ovpns1) port {3128,3129}
flags S/SA keep state
--0000000000009c321b058ba7cbfa
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
<div dir=3D"ltr">Hello.<div><br></div><div>I have to limit the Download/Upl=
oad speed of my OpenVPN users. I use Squid (in transparent mode) for cachin=
g and logging their web traffic. I use pfSense, which is based on FreeBSD 1=
1.2-RELEASE.</div><div><br></div><div>pf, Squid and OpenVPN work great, the=
problem starts when dummynet comes into play. dummynet just doesn't wo=
rk when Squid is enabled, but it works great when I disable squid. I've=
included my pf.conf. It seems OK to me, but I am very new to pf.</div><div=
><br></div><div>I tried to pass the traffic to dummynet immediately after r=
edirecting HTTP and HTTPS traffics to ports 3128 and 3129 respectively, but=
it didn't work:</div><div><br></div><div>pass =C2=A0in =C2=A0quick =C2=
=A0on $OpenVPN inet proto tcp =C2=A0from any to any port 3128 tracker 15609=
24429 flags S/SA keep state =C2=A0dnpipe ( 1,2)<br></div><div>pass =C2=A0in=
=C2=A0quick =C2=A0on $OpenVPN inet proto tcp =C2=A0from any to any port 31=
29 tracker 1560924399 flags S/SA keep state =C2=A0dnpipe ( 1,2)</div><div><=
br></div><div>(changing the interface to $loopback also didn't help)</d=
iv><div><br></div><div>I also tried to pass packets destined for <a href=3D=
"http://127.0.0.1:3128">127.0.0.1:3128</a> and 3129 to dummynet with these =
rules, but it also didn't work (placing them in appropriate section, be=
fore other rules).</div><div><br></div><div>pass in =C2=A0on $loopback inet=
proto tcp from any to any port 3128 dnpipe(1,2)<br></div><div><div>pass in=
=C2=A0on $loopback inet proto tcp from any to any port 3129 dnpipe(1,2)<br=
></div><div><br></div><div>I even changed the last rule of the file to this=
, but it also didn't work either:<br></div></div><div>pass in quick on =
ovpns1 proto tcp from any to (ovpns1) port {3128,3129} flags S/SA keep stat=
e dnpipe(1,2)<br></div><div><br></div><div>I tried a lot of other stuffs, n=
one of them worked when squid was enabled. Anyway, this is the whole pf.con=
f, generated by pfSense.</div><div><br></div><div>Could you please help me =
find the problem?</div><div><br></div><div>Thank you very much.</div><div><=
br></div><div>set limit table-entries 400000<br>set optimization normal<br>=
set limit states 97000<br>set limit src-nodes 97000<br><br>#System aliases<=
br>=C2=A0=C2=A0<br>loopback =3D "{ lo0 }"<br>WAN =3D "{ em0 =
}"<br>LAN =3D "{ ovpns1 }"<br>OpenVPN =3D "{ openvpn }&=
quot;<br><br>#SSH Lockout Table<br>table <sshguard> persist<br>#Snort=
tables<br>table <snort2c><br>table <virusprot><br>table <bo=
gons> persist file "/etc/bogons"<br>table <vpn_networks>=
{ <a href=3D"http://192.168.10.0/24">192.168.10.0/24</a> }<br>table <ne=
gate_networks> { <a href=3D"http://192.168.10.0/24">192.168.10.0/24</a> =
}<br><br># User Aliases=C2=A0<br>=C2=A0<br># Gateways<br>GWWANGW =3D "=
route-to ( em0 172.19.20.1 ) "<br>GWWAN_DHCP =3D " route-to ( em=
0 172.19.20.1 ) "<br>GWLAN_VPNV4 =3D " route-to ( ovpns1 192.168.=
10.1 ) "<br>GWLAN_VPNV6 =3D " route-to ( ovpns1 192.168.10.1 ) &q=
uot;<br><br>=C2=A0<br>set loginterface ovpns1<br><br>set skip on pfsync0<br=
><br>scrub on $WAN all =C2=A0 =C2=A0fragment reassemble<br>scrub on $LAN al=
l =C2=A0 =C2=A0fragment reassemble<br><br><br>no nat proto carp<br>no rdr p=
roto carp<br>nat-anchor "natearly/*"<br>nat-anchor "natrules=
/*"<br><br><br># Outbound NAT rules (automatic)<br><br># Subnets to NA=
T=C2=A0<br>tonatsubnets =3D "{ <a href=3D"http://127.0.0.0/8">127.0.0.=
0/8</a> ::1/128 <a href=3D"http://192.168.10.0/24">192.168.10.0/24</a> }&qu=
ot;<br>nat on $WAN inet from $tonatsubnets to any port 500 -> <a href=3D=
"http://172.19.20.101/32">172.19.20.101/32</a> =C2=A0static-port<br>nat on =
$WAN inet6 from $tonatsubnets to any port 500 -> (em0) =C2=A0static-port=
<br>nat on $WAN inet from $tonatsubnets to any -> <a href=3D"http://172.=
19.20.101/32">172.19.20.101/32</a> port 1024:65535=C2=A0<br>nat on $WAN ine=
t6 from $tonatsubnets to any -> (em0) port 1024:65535=C2=A0<br><br># Loa=
d balancing anchor<br>rdr-anchor "relayd/*"<br># TFTP proxy<br>rd=
r-anchor "tftp-proxy/*"<br><br># Setup Squid proxy redirect<br>rd=
r pass on ovpns1 proto tcp from any to !(ovpns1) port 80 -> 127.0.0.1 po=
rt 3128<br>rdr pass on ovpns1 proto tcp from any to !(ovpns1) port 443 ->=
; 127.0.0.1 port 3129<br><br># UPnPd rdr anchor<br>rdr-anchor "miniupn=
pd"<br><br>anchor "relayd/*"<br>anchor "openvpn/*"=
<br>anchor "ipsec/*"<br># block IPv4 link-local. Per RFC 3927, li=
nk local "MUST NOT" be forwarded by a routing device,<br># and cl=
ients "MUST NOT" send such packets to a router. FreeBSD won't=
route 169.254./16, but<br># route-to can override that, causing problems s=
uch as in redmine #2073<br>block in log quick from <a href=3D"http://169.25=
4.0.0/16">169.254.0.0/16</a> to any tracker 1000000101 label "Block IP=
v4 link-local"<br>block in log quick from any to <a href=3D"http://169=
.254.0.0/16">169.254.0.0/16</a> tracker 1000000102 label "Block IPv4 l=
ink-local"<br>#-------------------------------------------------------=
--------------------<br># default deny rules<br>#--------------------------=
-------------------------------------------------<br>block in log inet all =
tracker 1000000103 label "Default deny rule IPv4"<br>block out lo=
g inet all tracker 1000000104 label "Default deny rule IPv4"<br>b=
lock in log inet6 all tracker 1000000105 label "Default deny rule IPv6=
"<br>block out log inet6 all tracker 1000000106 label "Default de=
ny rule IPv6"<br><br># IPv6 ICMP is not auxilary, it is required for o=
peration<br># See man icmp6(4)<br># 1 =C2=A0 =C2=A0unreach =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 Destination unreachable<br># 2 =C2=A0 =C2=A0toobig =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0Packet too big<br># 128 =C2=A0echoreq =C2=A0 =C2=A0=
=C2=A0 =C2=A0 Echo service request<br># 129 =C2=A0echorep =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 Echo service reply<br># 133 =C2=A0routersol =C2=A0 =C2=A0 =C2=
=A0 Router solicitation<br># 134 =C2=A0routeradv =C2=A0 =C2=A0 =C2=A0 Route=
r advertisement<br># 135 =C2=A0neighbrsol =C2=A0 =C2=A0 =C2=A0Neighbor soli=
citation<br># 136 =C2=A0neighbradv =C2=A0 =C2=A0 =C2=A0Neighbor advertiseme=
nt<br>pass =C2=A0quick inet6 proto ipv6-icmp from any to any icmp6-type {1,=
2,135,136} tracker 1000000107 keep state<br><br># Allow only bare essential=
icmpv6 packets (NS, NA, and RA, echoreq, echorep)<br>pass out =C2=A0quick =
inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type {129,133,134,1=
35,136} tracker 1000000108 keep state<br>pass out =C2=A0quick inet6 proto i=
pv6-icmp from fe80::/10 to ff02::/16 icmp6-type {129,133,134,135,136} track=
er 1000000109 keep state<br>pass in =C2=A0quick inet6 proto ipv6-icmp from =
fe80::/10 to fe80::/10 icmp6-type {128,133,134,135,136} tracker 1000000110 =
keep state<br>pass in =C2=A0quick inet6 proto ipv6-icmp from ff02::/16 to f=
e80::/10 icmp6-type {128,133,134,135,136} tracker 1000000111 keep state<br>=
pass in =C2=A0quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6=
-type {128,133,134,135,136} tracker 1000000112 keep state<br>pass in =C2=A0=
quick inet6 proto ipv6-icmp from :: to ff02::/16 icmp6-type {128,133,134,13=
5,136} tracker 1000000113 keep state<br># We use the mighty pf, we cannot b=
e fooled.<br>block log quick inet proto { tcp, udp } from any port =3D 0 to=
any tracker 1000000114 label "Block traffic from port 0"<br>bloc=
k log quick inet proto { tcp, udp } from any to any port =3D 0 tracker 1000=
000115 label "Block traffic to port 0"<br>block log quick inet6 p=
roto { tcp, udp } from any port =3D 0 to any tracker 1000000116 label "=
;Block traffic from port 0"<br>block log quick inet6 proto { tcp, udp =
} from any to any port =3D 0 tracker 1000000117 label "Block traffic t=
o port 0"<br><br># Snort package<br>block log quick from <snort2c&g=
t; to any tracker 1000000118 label "Block snort2c hosts"<br>block=
log quick from any to <snort2c> tracker 1000000119 label "Block=
snort2c hosts"<br><br># SSH lockout<br>block in log quick proto tcp f=
rom <sshguard> to (self) port 22 tracker 1000000301 label "sshgu=
ard"<br><br># webConfigurator lockout<br>block in log quick proto tcp =
from <sshguard> to (self) port 443 tracker 1000000351 label "GUI=
Lockout"<br>block in log quick from <virusprot> to any tracker =
1000000400 label "virusprot overload table"<br>pass in =C2=A0quic=
k on { em0 } proto tcp from any to { 172.19.20.101 } port { 8003 8002 } tra=
cker 1000000551 keep state(sloppy)<br>pass out =C2=A0quick on { em0 } proto=
tcp from any to any flags any tracker 1000000552 keep state(sloppy)<br># a=
llow our DHCP client out to the WAN<br>pass in =C2=A0quick on $WAN proto ud=
p from any port =3D 67 to any port =3D 68 tracker 1000000561 label "al=
low dhcp client out WAN"<br>pass out =C2=A0quick on $WAN proto udp fro=
m any port =3D 68 to any port =3D 67 tracker 1000000562 label "allow d=
hcp client out WAN"=C2=A0<br># Not installing DHCP server firewall rul=
es for WAN which is configured for DHCP.<br>antispoof log for $WAN tracker =
1000001570<br>antispoof log for $LAN tracker 1000002620<br><br># loopback<b=
r>pass in =C2=A0on $loopback inet all tracker 1000003711 label "pass I=
Pv4 loopback"<br>pass out =C2=A0on $loopback inet all tracker 10000037=
12 label "pass IPv4 loopback"<br>pass in =C2=A0on $loopback inet6=
all tracker 1000003713 label "pass IPv6 loopback"<br>pass out =
=C2=A0on $loopback inet6 all tracker 1000003714 label "pass IPv6 loopb=
ack"<br># let out anything from the firewall host itself and decrypted=
IPsec traffic<br>pass out =C2=A0inet all keep state allow-opts tracker 100=
0003715 label "let out anything IPv4 from firewall host itself"<b=
r>pass out =C2=A0inet6 all keep state allow-opts tracker 1000003716 label &=
quot;let out anything IPv6 from firewall host itself"<br><br>pass out =
=C2=A0route-to ( em0 172.19.20.1 ) from 172.19.20.101 to !<a href=3D"http:/=
/172.19.20.0/24">172.19.20.0/24</a> tracker 1000003811 keep state allow-opt=
s label "let out anything from firewall host itself"<br>pass out =
=C2=A0route-to ( ovpns1 192.168.10.1 ) from 192.168.10.1 to !<a href=3D"htt=
p://192.168.10.0/24">192.168.10.0/24</a> tracker 1000003812 keep state allo=
w-opts label "let out anything from firewall host itself"<br># ma=
ke sure the user cannot lock himself out of the webConfigurator or SSH<br>p=
ass in =C2=A0quick on ovpns1 proto tcp from any to (ovpns1) port { 443 80 2=
2 } tracker 10000 keep state label "anti-lockout rule"<br><br># U=
ser-defined rules follow<br><br>anchor "userrules/*"<br># array k=
ey "enc0" does not exist for "" in array: {WAN LAN Open=
VPN } label "USER_RULE"<br># array key "l2tp" does not =
exist for "" in array: {WAN LAN OpenVPN } label "USER_RULE&q=
uot;<br>pass =C2=A0in =C2=A0quick =C2=A0on $OpenVPN inet proto udp =C2=A0fr=
om any to any port 53 tracker 1560852911 keep state =C2=A0label "USER_=
RULE"<br>pass =C2=A0in =C2=A0quick =C2=A0on $OpenVPN inet proto tcp =
=C2=A0from any to any port 53 tracker 1560852890 flags S/SA keep state =C2=
=A0label "USER_RULE"<br>pass =C2=A0in =C2=A0quick =C2=A0on $OpenV=
PN inet proto tcp =C2=A0from any to any port 3128 tracker 1560924429 flags =
S/SA keep state =C2=A0dnpipe ( 1,2) =C2=A0label "USER_RULE"<br>pa=
ss =C2=A0in =C2=A0quick =C2=A0on $OpenVPN inet proto tcp =C2=A0from any to =
any port 3129 tracker 1560924399 flags S/SA keep state =C2=A0dnpipe ( 1,2) =
=C2=A0label "USER_RULE"<br>block =C2=A0in =C2=A0quick =C2=A0on $O=
penVPN inet proto tcp =C2=A0from any to any tracker 1560924366 flags S/SA =
=C2=A0label "USER_RULE"<br>pass =C2=A0in =C2=A0quick =C2=A0on $WA=
N reply-to ( em0 172.19.20.1 ) inet proto tcp =C2=A0from any to any tracker=
1560337356 flags S/SA keep state =C2=A0label "USER_RULE"<br>pass=
=C2=A0in =C2=A0quick =C2=A0on $WAN reply-to ( em0 172.19.20.1 ) inet proto=
udp =C2=A0from any to any port 1194 tracker 1559381581 keep state =C2=A0la=
bel "USER_RULE: Allow OpenVPN to this firewall1"<br><br># VPN Rul=
es<br><br>anchor "tftp-proxy/*"<br><br># Setup squid pass rules f=
or proxy<br>pass in quick on ovpns1 proto tcp from any to (ovpns1) port {31=
28,3129} flags S/SA keep state<br></div></div>
--0000000000009c321b058ba7cbfa--