Proxy# cat /etc/pf.rules
#############################pf rules for marucom proxy###############
ext_if="fxp2 #outbound interface
int_if=fxp0 #inbound interface
pass in all
####skip filter loopback######
set skip on lo0
# Normalization: reassemble fragments and resolve or reduce traffic ambiguities.
scrub in all
rdr on $int_if inet proto tcp from any to any port 80 -> 127.0.0.1 port 3128
pass out quick on $ext_if inet proto tcp from any to any port 80 keep state
pass out quick on $ext_if proto tcp from $ext_if to any flags S/SA \
# allow ssh in, but limited to 5 attempts in 60 seconds before a ban is imposed on the connecting ip address.
pass in quick on $int_if proto tcp from any to $int_if port 22 flags S/SA keep state (max-src-conn-rate 5/60, overload <bruteforce> flush global)
pass in quick on $ext_if proto tcp from any to $ext_if port 22 flags S/SA keep state (max-src-conn-rate 5/60, overload <bruteforce> flush global)
pass in quick log on $int_if proto { tcp, udp } from 192.168.2.0/24 keep state
pass in quick log on $int_if proto { tcp, udp } from 192.168.5.0/24 keep state