#############################################
# MACROS
#############################################
# macros for interfaces
ext_if="nfe0"
lan_if="re0"
# networks
### Hosts
isengard ="10.0.1.100"
bt ="10.0.1.101"
### Queues, States and Types ###
IcmpType ="icmp-type 8 code 0"
SshQueue ="(ssh_bulk, ssh_login)"
SynState ="flags S/SAFR synproxy state"
TcpState ="flags S/SAFR modulate state"
UdpState ="keep state"
### Stateful Tracking Options (STO) ###
FtpSTO ="(tcp.established 7200)"
ext_ifSTO ="(max 9000, source-track rule, max-src-conn 2000, max-src-nodes 14)"
IntIfSTO ="(max 150, source-track rule, max-src-conn 50, max-src-nodes 14, max-src-conn-rate 75/20)"
SmtpSTO ="(max 200, source-track rule, max-src-states 50, max-src-nodes 50, max-src-conn-rate 30/10, overload <BLOCKTEMP> flush global)"
SshSTO ="(max 5, source-track rule, max-src-states 5, max-src-nodes 5, max-src-conn-rate 5/60)"
WebSTO ="(max 500, source-track rule, max-src-states 50, max-src-nodes 75, max-src-conn-rate 120/100, overload <BLOCKTEMP> flush global)"
# internal services
#$int_tcpPorts="{ 5801, 5901 }"
tcp_ports="{ ssh, www, 81 }"
isengard_ports="{ 6112, 51333 }"
#isengard_tcp_ports="{ 5800, 5900, 8000 }"
#############################################
# OPTIONS
#############################################
### Misc Options
set debug urgent
set reassemble yes
set require-order yes
set block-policy drop
set loginterface $ext_if
set state-policy if-bound
set fingerprints "/etc/pf.os"
set ruleset-optimization none
### Timeout Options
set optimization aggressive
set timeout { frag 30, tcp.established 120 }
set timeout { tcp.first 30, tcp.closing 30, tcp.closed 30, tcp.finwait 30 }
set timeout { udp.first 30, udp.single 30, udp.multiple 30 }
set timeout { other.first 30, other.single 30, other.multiple 30 }
#############################################
# QUEUE
#############################################
altq on $ext_if bandwidth 750Kb hfsc queue { ack, dns, norm, bulk }
queue ack bandwidth 30% priority 8 qlimit 500 hfsc (realtime 20%, ecn )
queue dns bandwidth 5% priority 7 qlimit 500 hfsc (realtime 5% )
queue ssh bandwidth 20% priority 6 qlimit 500 hfsc (realtime 20%) {ssh_login, ssh_bulk}
queue ssh_login bandwidth 50% priority 6 qlimit 500 hfsc
queue ssh_bulk bandwidth 50% priority 5 qlimit 500 hfsc
queue norm bandwidth 20% priority 5 qlimit 500 hfsc (realtime 20% )
queue bulk bandwidth 1% priority 2 qlimit 500 hfsc (upperlimit 95% default)
#############################################
# RULES
#############################################
antispoof log quick for { lo $lan_if ($ext_if) }
block log quick inet6
block in log quick on $ext_if inet from any to 255.255.255.255
block in log quick on $ext_if inet from urpf-failed to any
block in log quick on $ext_if inet from no-route to any
block log on $ext_if
block return log on $lan_if
#############################################
# SCRUB/NAT/RDR
#############################################
match out log on egress from (self) to any tag EGRESS nat-to ($ext_if:0) port 1024:65535
match out log on egress from any to any received-on $lan_if tag EGRESS nat-to ($ext_if:0) port 1024:65535
match out log on egress from $bt to any received-on $lan_if tag BITTOR nat-to ($ext_if:0) static-port
match log on $ext_if all scrub (random-id min-ttl 254 set-tos lowdelay reassemble tcp max-mss 1472)
### $ext_if inbound
pass in log on $ext_if proto tcp from any to ($ext_if) port $tcp_ports
pass in log on $ext_if proto tcp from any to ($ext_if) port $isengard_ports rdr-to $isengard
pass in log on $ext_if proto udp from any to ($ext_if) port $isengard_ports rdr-to $isengard
pass in log on $ext_if inet proto icmp from !($ext_if) to ($ext_if) $IcmpType $UdpState
### $lan_if outbound
pass out log on $lan_if inet proto tcp from $lan_if to $lan_if:network port ssh $TcpState
pass out log on $lan_if inet proto icmp from $lan_if to $lan_if:network $IcmpType $UdpState
### $lan_if inbound
pass in log on $lan_if
match in log on $lan_if proto tcp from $lan_if:network to any port 80 rdr-to 127.0.0.1 port 3128
### $ext_if outbound
pass out log on $ext_if inet proto tcp from ($ext_if) to !($ext_if) $TcpState $ext_ifSTO queue (bulk, ack) tagged EGRESS
pass out log on $ext_if inet proto tcp from ($ext_if) to !($ext_if) port ssh $TcpState $ext_ifSTO queue $SshQueue tagged EGRESS
#pass out log on $ext_if inet proto tcp from ($ext_if) to !($ext_if) port ftp $TcpState $FtpSTO queue (bulk) tagged EGRESS
pass out log on $ext_if inet proto udp from ($ext_if) to !($ext_if) $UdpState $ext_ifSTO queue (bulk) tagged EGRESS
pass out log on $ext_if inet proto udp from ($ext_if) to !($ext_if) port domain $UdpState $ext_ifSTO queue (dns) tagged EGRESS
pass out log on $ext_if inet proto icmp from ($ext_if) to !($ext_if) $UdpState $ext_ifSTO queue (bulk) tagged EGRESS