#######################################################
# Macros
#######################################################
ext_if="xl0"
int_if="fxp0"
dmz_if="rl0"
icmp_types = "{ echoreq, echorep, unreach }"
# Hosts & Network
my_net = "192.168.2.0/24"
private_lan = "{ 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8, 169.254.0.0/16, 192.0.2.0/24, 0.0.0.0/8, 240.0.0.0/4 }"
www_server = "192.168.2.2"
bittor_server = "192.168.2.3"
# Antiscan
SynState="flags S/SAFR synproxy state"
AntiScanPort="{23:79, 6000:8000}"
#######################################################
# Options
#######################################################
set debug urgent
set require-order yes
set block-policy drop
set loginterface $ext_if
set state-policy if-bound
set fingerprints "/etc/pf.os"
set ruleset-optimization none
set skip on lo
# Antiscan
AntiScanSTO ="(max 60, source-track rule, max-src-conn 1, max-src-nodes 60, max-src-conn-rate 5/60, overload flush global)"
#######################################################
# Table
#######################################################
table persist
#######################################################
# ALTQ
#######################################################
altq on $ext_if priq bandwidth 10000Kb queue { q_pri, q_def }
queue q_pri priority 7
queue q_def priority 1 priq(default)
#######################################################
# NAT Rules
#######################################################
nat on $ext_if from $my_net to any -> ($ext_if)
nat-anchor "ftp-proxy/*"
#######################################################
# Redirect Rules
#######################################################
rdr-anchor "ftp-proxy/*"
rdr on $int_if proto tcp from any to any port 21 -> 127.0.0.1 port 8021
# RDR for WWW server
rdr on $ext_if proto tcp from any to any port 80 -> $www_server
# RDR for Bittor server
rdr on $ext_if proto { tcp, udp } from any to any port 9996 -> $bittor_server
#######################################################
# Scrub
#######################################################
match in all scrub (no-df max-mss 1452)
#######################################################
# Block/Pass Rules
#######################################################
# Incoming rule
block all
# Block non-routable addresses from elsewhere
#block drop in quick on $ext_if from $private_lan to any
#block drop out quick on $ext_if from any to $private_lan
# Antiscan
block in quick on $ext_if from to any
# Antispoofing
antispoof for {lo $int_if}
# FTP
anchor "ftp-proxy/*"
# ICMP
pass inet proto icmp all icmp-type $icmp_types keep state
#
# PASS IN EXTERNAL
#
# ALTQ ACK
pass in on $ext_if proto tcp from any to $ext_if flags S/SA keep state queue (q_def, q_pri)
# SSH Access to Sentinel
pass in on $ext_if inet proto tcp from any to ($ext_if) port ssh flags S/SA keep state
pass in on $ext_if inet proto tcp from any to any port ssh modulate state (source-track rule max-src-nodes 8 max-src-conn 8 max-src-conn-rate 3/60)
# Access to bittor
pass in on $ext_if inet proto { tcp, udp } from any to $bittor_server port 9996 flags S/SA synproxy state queue (q_def, q_pri)
# Access to WWW server
pass in on $ext_if inet proto tcp from any to $www_server port 80 flags S/SA syn proxy state queue (q_def, q_pri)
# Antiscan
pass in on $ext_if inet proto tcp from any to any port $AntiScanPort $SynState $AntiScanSTO
#
# PASS OUT EXTERNAL
#
# Allow outgoing traffic to do as it pleases
pass out on $ext_if proto { udp, icmp } all keep state
pass out on $ext_if proto tcp from $ext_if to any flags S/SA keep state queue (q_def, q_pri)
#
# PASS LAN Interface
#
# Allow LAN to do anything
pass in on $int_if from $int_if:network to any keep state
#
# DMZ
#
pass in on $dmz_if inet proto tcp from any to any port ssh modulate state (source-track rule max-src-nodes 8 max-src-conn 8 max-src-conn-rate 3/60) queue(q_def, q_pri)
