# VPN INTERFACE
ext_if = "tun0"
# PROVIDER ETHERNET INTERFACE
neo_if = "rl1"
# CLIENT INTERFACES
rub_if = "rl0"
zta_if = "tun1"
int_if = "{rl0, tun1}"
# ALL INTERFACES
all_if = "{tun0, tun1, rl0, rl1, lo}"
set block-policy return
# ALLOWED OUTGOING PORTS
out_ports = "{21, 22, 80, 443, 5190, 8080, 6667}"
# ALLOWED HOSTS
allowed_hosts = "{192.168.197.0/24, 192.168.1.0/24}"
# NAT RULE
nat on $ext_if from $allowed_hosts to !192.168.0.0/16 -> ($ext_if:0)
# FILTER RULES
block all
# PASSING DNS
pass out on $ext_if inet proto {tcp,udp} from ns.mydomain to ns.provider port 53 keep state
# PASSING LOCAL
pass in on $int_if inet proto {tcp,udp} from $allowed_hosts to $int_if port 53 keep state
# PASSING OPENVPN TRAFFIC to PROVIDER
pass out on $neo_if inet proto {tcp,udp} from $neo_if to 192.168.130.1 port 5000 keep state
#PASSING TRAFFIC FROM VPN PEER
pass in on $neo_if inet proto {tcp,udp} from 192.168.8.12 to $neo_if port 5000 keep state
#PASSING ICMP
pass in on $all_if inet proto icmp all keep state
pass out on $all_if inet proto icmp all keep state