###########
# Options #
###########
set block-policy return
set loginterface $ext_if
set skip on lo0
#########
# SCRUB #
########## normalizacja datagramow
scrub in
########
# ALTQ #
########
# altq na wewn?etrznym interfejsie.
altq on $int_if cbq bandwidth 6Mb queue { ssh_in, mail_in, www_in, rest_in }
queue ssh_in bandwidth 500Kb priority 7
queue mail_in bandwidth 1500Kb cbq priority 3 {mail_smtp_in,mail_pop3_in}
queue mail_smtp_in bandwidth 600Kb cbq(borrow)
rdr pass on $int_if proto tcp from any to any port 21 -> 127.0.0.1 \
port 8021
rdr on $ext_if proto {tcp, udp} from any to any port $good_ports -> $comp1
pass in quick on $ext_if proto {tcp, udp} from any to $comp1 port $good_ports \
flags S/SA synproxy state
block in quick on $ext_if from $priv_nets to any
block out quick on $ext_if from any to $priv_nets
pass in on $ext_if inet proto tcp from any to ($ext_if) \
port $tcp_services flags S/SA keep state
#serv_ftp
#pass in on $ext_if proto tcp from any to any port 21 keep state
#pass in on $ext_if proto tcp from any to any port > 49151 \
# keep state
pass in inet proto icmp all icmp-type $icmp_types keep state
pass in on $int_if from $int_if:network to any keep state
#pass out on $int_if from any to $int_if:network keep state
pass out on $ext_if proto tcp all modulate state flags S/SA
pass out on $ext_if proto { udp, icmp } all keep state
pass out on $ext_if inet proto ipv6 from $ext_if to $ipv6_pop keep state
pass in on $ext_if inet proto ipv6 from $ipv6_pop to $ext_if keep state
pass out on $ipv6_if inet6 all keep state
pass in on $ipv6_if inet6 all keep state
## no linux please on protected ports
#block in quick on $ext_if inet proto tcp from any os Linux to any port $protected
# special rule for ssh
pass in on $ext_if proto tcp from any to ($ext_if) port ssh \
flags S/SA keep state \
(max-src-conn-rate 2/20, overload <bruteforce> flush global)
pass out on $ext_if proto tcp from any to any flags S/SA \
modulate state queue (rest_out, ssh_out)
#pass out on $ext_if inet proto tcp from any to any 22 flags S/SA keep state queue (rest_out, ssh_out)
#pass out on $ext_if inet proto tcp from any to any port 25\
#flags S/SA modulate state queue mail_smtp_out
#pass out on $ext_if inet proto tcp from any to any port 110\
#flags S/SA modulate state queue mail_pop3_out
pass out on $ext_if inet proto tcp from any to any port 80 \
flags S/SA modulate state queue www_out
pass out on $int_if inet proto tcp from any port 80 to any \
queue www_in
pass out on $int_if inet proto tcp from any port 22 to any \
queue (rest_in, ssh_in)
#pass out on $int_if inet proto tcp from any port to any 25 queue mail_smtp_in
pass out on $int_if inet proto tcp from any port 110 to any queue mail_pop3_in