#########
# MACROS #
##########
int_if = "rl1"
ext_if = "rl0"
ipv6_if = "gif0"
ipv6_net = "{ 3ffe:80ee:3a17:0:0:0:0:0/48 }"
ipv6_pop = "195.28.165.254"
comp1 = "192.168.1.103"
good_ports = "{ 1025,6881:6889,10000:60000 }"
tcp_services = "{ 22,80,113 }"
icmp_types = "echoreq"
priv_nets = "{ 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8, 255.255.255.255/32 }"
bad_ports = "{ 69,135,137,138,139,445,524,548,1433,6000,31337,666,12345 }"
table <bruteforce> persist
###########
# Options #
###########
set block-policy return
set loginterface $ext_if
set skip on lo0
#########
# SCRUB #
########## normalizacja datagramow
scrub in
########
# ALTQ #
########
# altq na wewn?etrznym interfejsie.
altq on $int_if cbq bandwidth 6Mb queue { ssh_in, mail_in, www_in, rest_in }
queue ssh_in bandwidth 500Kb priority 7
queue mail_in bandwidth 1500Kb cbq priority 3 {mail_smtp_in,mail_pop3_in}
queue mail_smtp_in bandwidth 600Kb cbq(borrow)
queue mail_pop3_in bandwidth 900Kb cbq(borrow)
queue www_in bandwidth 2Mb priority 5 cbq(borrow)
queue rest_in bandwidth 2Mb priority 1 cbq(borrow default)
# altq na zewn?etrznym interfejsie
altq on $ext_if cbq bandwidth 370Kb queue { ssh_out, mail_out, www_out, rest_out }
queue ssh_out bandwidth 40Kb priority 7
queue mail_out bandwidth 80Kb priority 3 {mail_smtp_out,mail_pop3_out}
queue mail_smtp_out bandwidth 30Kb cbq(borrow)
queue mail_pop3_out bandwidth 50Kb cbq(borrow)
queue www_out bandwidth 150Kb priority 5 cbq(borrow)
queue rest_out bandwidth 100Kb priority 1 cbq(borrow default)
###########
# NAT/RDR #
###########
nat on $ext_if from $int_if:network to any -> ($ext_if)
nat-anchor "ftp-proxy/*"
rdr-anchor "ftp-proxy/*"
rdr pass on $int_if proto tcp from any to any port 21 -> 127.0.0.1 \
port 8021
rdr on $ext_if proto {tcp, udp} from any to any port $good_ports -> $comp1
# regulki filtra pakietow
block in
pass quick on lo0 all
anchor "ftp-proxy/*"
antispoof quick for { lo $int_if }
# block the ssh bruteforce bastards
block drop in quick on $ext_if from <bruteforce>
# block bad ports and external broadcasts
block in quick proto { udp,tcp } from any to any port $bad_ports
block in quick on $ext_if from any to 255.255.255.255
pass in quick on $ext_if inet proto {tcp, udp} from any to any port domain keep state
pass in quick on $ext_if proto {tcp, udp} from any to $comp1 port $good_ports \
flags S/SA synproxy state
block in quick on $ext_if from $priv_nets to any
block out quick on $ext_if from any to $priv_nets
pass in on $ext_if inet proto tcp from any to ($ext_if) \
port $tcp_services flags S/SA keep state
#serv_ftp
#pass in on $ext_if proto tcp from any to any port 21 keep state
#pass in on $ext_if proto tcp from any to any port > 49151 \
# keep state
pass in inet proto icmp all icmp-type $icmp_types keep state
pass in on $int_if from $int_if:network to any keep state
#pass out on $int_if from any to $int_if:network keep state
pass out on $ext_if proto tcp all modulate state flags S/SA
pass out on $ext_if proto { udp, icmp } all keep state
pass out on $ext_if inet proto ipv6 from $ext_if to $ipv6_pop keep state
pass in on $ext_if inet proto ipv6 from $ipv6_pop to $ext_if keep state
pass out on $ipv6_if inet6 all keep state
pass in on $ipv6_if inet6 all keep state
## no linux please on protected ports
#block in quick on $ext_if inet proto tcp from any os Linux to any port $protected
# special rule for ssh
pass in on $ext_if proto tcp from any to ($ext_if) port ssh \
flags S/SA keep state \
pass out on $ext_if proto tcp from any to any flags S/SA \
modulate state queue (rest_out, ssh_out)
#pass out on $ext_if inet proto tcp from any to any 22 flags S/SA keep state queue (rest_out, ssh_out)
#pass out on $ext_if inet proto tcp from any to any port 25\
#flags S/SA modulate state queue mail_smtp_out
#pass out on $ext_if inet proto tcp from any to any port 110\
#flags S/SA modulate state queue mail_pop3_out
pass out on $ext_if inet proto tcp from any to any port 80 \
flags S/SA modulate state queue www_out
pass out on $int_if inet proto tcp from any port 80 to any \
queue www_in
pass out on $int_if inet proto tcp from any port 22 to any \
queue (rest_in, ssh_in)
#pass out on $int_if inet proto tcp from any port to any 25 queue mail_smtp_in
pass out on $int_if inet proto tcp from any port 110 to any queue mail_pop3_in (max-src-conn-rate 2/20, overload <bruteforce> flush global)