# kermit's /etc/pf.conf
# interfaces
riv_if="sis0"
net_if="sis1"
int_if="sis2"
antares = "10.90.0.1"
frog = "10.0.0.2"
# internet shares
table <shares> const file "/etc/pf.shares"
# open services
services_riv = "{ ftp, ssh, smtp, www, https, imaps, 6668 }"
services_net = "{ ssh, smtp, www, https, imaps, 6668 }"
### script begins here
# scrub incoming packets
scrub in all
## nat rules
# nat on internet for local network and shares
nat pass on $net_if from $int_if:network to any -> $net_if
nat pass on $riv_if from $int_if:network to $riv_if:network -> $riv_if
#nat pass on $net_if from <shares> to any -> $net_if
# redirect irc to antares
rdr pass on $net_if proto tcp from any to any \
port { 6667, 9999 } -> $antares
# services redirections
#rdr pass on $riv_if proto tcp from $riv_if:network to $riv_if \
# port $services_riv -> $frog
rdr pass on $net_if proto tcp from any to $net_if \
port $services_net -> $frog
## filtering rules
# standard behavior : block all, allow localhost
block all
block return in quick on { $net_if, $riv_if } proto tcp \
from any to any port 113
pass quick on lo0 all
antispoof quick for lo0
# allow ssh from local network
pass in on $int_if inet proto tcp from $int_if:network to $int_if \
port ssh flags S/SA keep state
# allow echo request icmp and dns (from internal, internet and shares)
pass in inet proto icmp all icmp-type echoreq keep state
pass in on $net_if inet proto { tcp, udp } \
from any to $net_if port 53 keep state
pass in on $int_if inet proto udp \
from $int_if:network to $int_if port 53 keep state
pass in on $riv_if inet proto udp \
from <shares> to $riv_if port 53 keep state
# allow traffic from local network to internet
pass in on $int_if from $int_if:network to any keep state
pass out on $int_if all keep state
pass out on $riv_if all keep state
pass out on $net_if all keep state