#216.16.215.115 = mail#216.16.215.107 = cubetunnelendv4=216.218.224.42ext_if="fxp0"v6_if="gif0"addr_1="216.16.215.115"addr_1_tcp="{ 25 80 110 44337 55055 }"addr_1_udp="{ 53 }"addr_2="216.16.215.107"addr_2_tcp="{ 22 53 80 113 6667 6697 7029 57000 }"addr_2_udp="{ 53 113 }"set timeout { interval 10, frag 30 }set timeout { tcp.first 120, tcp.opening 30, tcp.established 86400 }set timeout { tcp.closing 300, tcp.finwait 30, tcp.closed 45 }set timeout { udp.first 60, udp.single 30, udp.multiple 60 }set timeout { icmp.first 20, icmp.error 10 }set timeout { other.first 60, other.single 30, other.multiple 60 }set timeout { adaptive.start 0, adaptive.end 0 }set limit { states 10000, frags 5000 }set loginterface noneset optimization normalset block-policy dropset require-order yesset fingerprints "/etc/pf.os"set skip on lo0set skip on ed0scrub in allpass in on $ext_if inet proto ipv6 all keep statepass out on $ext_if inet proto ipv6 all keep stateblock in log alltable <sshguard> persisttable <apachedos> persistblock in quick on $ext_if from <sshguard> label "ssh bruteforce"block in quick on $ext_if from <apachedos> label "apache dos"#pass in allpass out all#pass in quick on $ext_if proto ipv6 all#pass out quick on $ext_if proto ipv6 all#pass in on $ext_if proto tcp to $tunnel_end4 \#port 113 modulate state \#(max-src-conn 50, max-src-conn-rate 10/10, overload <apachedos> flush) pass out on $ext_if proto { tcp, udp } all keep statepass in on $ext_if proto tcp from any to $addr_1 port $addr_1_tcp keep statepass in on $ext_if proto udp from any to $addr_1 port $addr_1_udp keep statepass in on $ext_if proto tcp from any to $addr_2 port $addr_2_tcp keep statepass in on $ext_if proto udp from any to $addr_2 port $addr_2_udp keep state