fastweb="xl0"
table <spamd> persist
table <spamd-white> persist
table <fw-dhcpd> persist { 41.5.120.1, 41.5.120.2, 41.5.120.3 }
table <fw-allow> persist { 41.19.150.66, 36.244.168.46 }
table <fw-bnc> persist { 41.19.150.66, 36.244.168.46 }
rfc_1918 = "{ 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8 }"
bnc = "{ 31337, 31338, 31339, 31340, 31341, 31341, 31342, 31343, 31344, 31345, 31346, 31347, 31348, 31349, 31350 }"
set skip on lo
set timeout { interval 10, frag 30 }
set block-policy drop
set limit { frags 5000, src-nodes 10000, states 10000 }
set optimization normal
set state-policy if-bound
set loginterface $fastweb
scrub in on $fastweb all fragment reassemble min-ttl 15 max-mss 1400
scrub out on $fastweb all random-id fragment reassemble
scrub on $fastweb all reassemble tcp
anchor "ftp-proxy/*"
block in
pass out keep state
block drop in quick on $fastweb inet from $rfc_1918 to any
antispoof quick for { lo }
#pass in quick proto esp from any to $fastweb
#pass in quick proto udp from any port = 500 to $fastweb port = 500 keep state
#pass in quick on enc0 all
pass in on $fastweb proto { tcp, udp } from <fw-dhcpd> to $fastweb keep state
pass in on $fastweb proto tcp from <fw-allow> to ($fastweb) port ssh keep state
pass in on $fastweb proto tcp from <fw-bnc> to ($fastweb) port $bnc keep state