ext_if = "re0"int_if = "rl0"jls_if = "vlan0"ext_ip = "192.168.1.1"int_ip = "192.168.0.1"rtr_ip = "192.168.1.254"jails_ip = "10.0.0.0/8"local_ip = "192.168.0.0/32"mastr_ip = "192.168.1.0/32"conn_attempts = "3"conn_timelimit = "5"tcp_pass_in = "{ 80 }"tcp_pass_out = "{ 20 21 22 80 1002 10122 }"udp_pass_in = "{ 53 }"udp_pass_out = "{ 53 }"icmp_types = "echoreq"###############set block-policy returnset loginterface $ext_ifset skip on lo0scrub in all########### LANnat on $ext_if from $int_if:network to any -> ($ext_if)# SSHrdr pass on $ext_if proto tcp from any to $ext_ip port 59184 -> 10.0.0.2 port 22rdr pass on $int_if proto tcp from $int_if:network to $ext_ip port 22 -> $ext_ip port 59184rdr pass on $int_if proto tcp from $int_if:network to $ext_ip port 10022 -> 10.0.0.2 port 22rdr pass on $int_if proto tcp from $int_if:network to $ext_ip port 10122 -> 10.0.0.3 port 22# carbolymerrdr pass on $ext_if proto tcp from any to $ext_ip port 10222 -> 10.0.0.4 port 22# monikardr pass on $ext_if proto tcp from any to $ext_ip port 10322 -> 10.0.0.3 port 22# przemekrdr pass on $ext_if proto tcp from any to $ext_ip port 10422 -> 10.0.0.6 port 22# ~~~~~~~~~~~~~~~~~ SQUID ~~~~~~~~~~~~~~~~~~~~## wwwrdr pass on { $int_if $ext_if } proto tcp from any to $ext_ip port 80 -> 10.0.0.2rdr pass on $int_if proto tcp from any to $ext_ip port { 85 90 } -> 10.0.0.2rdr on $int_if proto tcp from 192.168.0.0/24 to { any, !$ext_ip, !$rtr_ip } port 80 -> $ext_ip port 8080########### JAILSnat on $ext_if proto { icmp tcp } from $jails_ip to any -> $ext_ip###########block return log all############# PIOTREKblock out log quick on $int_if proto { tcp, udp } from 192.168.1.103 to anypass out on $int_if proto tcp from 192.168.1.103 to any port { 21, 53, 80 }# ADRIANblock out log quick on $ext_if proto { tcp, udp } from 192.168.0.102 to anyblock out log quick on $int_if proto { tcp, udp } from 192.168.0.102 to anyblock in log quick on $ext_if proto { tcp, udp } from 192.168.0.102 to anyblock in log quick on $int_if proto { tcp, udp } from 192.168.0.102 to any#pass out log on $ext_if proto tcp from 192.168.1.102 to any port { 21, 53 }##############block out log quick on $ext_if proto tcp from 192.168.0.101 to any port 80pass in quick on $ext_if from 192.168.1.1 to $jails_ip keep statepass out quick on $ext_if from 192.168.1.1 to $jails_ip keep state# Default policy from std in/out ports#pass in quick on $ext_if proto tcp from any to $ext_ip port $tcp_pass_in keep state#pass in quick on $ext_if proto udp from any to $ext_ip port $udp_pass_in keep state#pass out on $int_if proto tcp from { $local_ip $jails_ip $mastr_ip } to any port $tcp_pass_out keep state#pass out on $int_if proto udp from { $local_ip $jails_ip $mastr_ip } to any port $udp_pass_out keep state# allow all traffic from internal network to internal interfacepass in on $int_if from $int_if:network to any keep statepass out on $int_if from any to $int_if:network keep state# allow all traffic out via external interfacepass out on $ext_if proto tcp all modulate state flags S/SApass out on $ext_if proto { udp, icmp } all keep state