# $OpenBSD: pf.conf,v 1.35 2008/02/29 17:04:55 reyk Exp $
#
# See pf.conf(5) and /usr/share/pf for syntax and examples.
# Remember to set net.inet.ip.forwarding=1 and/or net.inet6.ip6.forwarding=1
# in /etc/sysctl.conf if packets are to be forwarded between interfaces.
ext_if = "pppoe0"
int_if = "{ vr1 vr2 vr3 }"
voip_ports = "{ 5060, 10000:20000 }"
rt = "{ 22145:22245 }"
rtorrent = "192.168.2.100"
set skip on lo
scrub in
#ALTQ for VOIP traffic
altq on $ext_if priq bandwidth 5Mb queue { q_voip, q_def }
queue q_voip priority 7
queue q_def priority 1 priq(default)
nat-anchor "ftp-proxy/*"
rdr-anchor "ftp-proxy/*"
nat on $ext_if from !($ext_if) -> ($ext_if:0)
rdr pass on $int_if proto tcp to port ftp -> 127.0.0.1 port 8021
rdr pass on $int_if proto udp to port domain -> 127.0.0.1 port 53
#rtorrent
rdr on $ext_if proto { tcp, udp } from any to ($ext_if) port $rt -> $rtorrent
anchor "ftp-proxy/*"
block in log
block inet6
pass out
pass quick on $int_if no state
antispoof quick for { lo $ext_if }
antispoof quick for { vr1 vr2 vr3 }
#Allow SIP and RTP traffic from ITSP
pass out on $ext_if proto udp to x.x.x.x port $voip_ports queue q_voip
pass in on $ext_if proto udp from x.x.x.x to ($ext_if) port $voip_ports queue q_voip
#Allow SIP and RTP traffic from ITSP
pass out on $ext_if proto udp to x.x.x.x port $voip_ports queue q_voip
pass in on $ext_if proto udp from x.x.x.x to ($ext_if) port $voip_ports queue q_voip
#rtorrent
pass in on $ext_if proto { tcp, udp }from any to $rtorrent port $rt synproxy state