WAN="hme1"
LAN="hme2"
WLAN="hme3"
DMZ1="hme4"
DMZ2="hme5"
DMZ3="hme6"
IPV6="gif0"
table <firewall> const {self}
table <IPSpoof-LAN> file "/etc/pf/spoofing/IPSpoof-LAN"
table <IPSpoof-WLAN> file "/etc/pf/spoofing/IPSpoof-WLAN"
table <IPSpoof-DMZ1> file "/etc/pf/spoofing/IPSpoof-DMZ1"
table <IPSpoof-DMZ2> file "/etc/pf/spoofing/IPSpoof-DMZ2"
table <IPSpoof-DMZ3> file "/etc/pf/spoofing/IPSpoof-DMZ3"
table <DNS-Servers> file "/etc/pf/services/DNS-Servers"
table <defaultdrop> file "/etc/pf/default/defaultdrop"
table <dropicmp> file "/etc/pf/default/dropicmp"
INTERNET="{ ! <firewall>, ! <IPSpoof-LAN>, ! <IPSpoof-WLAN>, ! <IPSpoof-DMZ1>, ! <IPSpoof-DMZ2>, ! <IPSpoof-DMZ3>, 0/0 }"
set skip on lo
set loginterface hme0
scrub in
# ------------------------- NAT ------------------------------
nat on $WAN from <IPSpoof-LAN> to $INTERNET -> ($WAN) # vr: LAN HIDE-NAT
nat on $WAN from <IPSpoof-WLAN> to $INTERNET -> ($WAN) # vr: WLAN HIDE-NAT
# -------------------------------------------------------------
# DEFAULT POLICY
block in log
# DEFAULT DROP
block log quick from <defaultdrop> # vr: Block Specific Users
block log quick proto icmp from <dropicmp> # vr: Disable ICMP for Specific Users
# SPOOFING
block in log quick on $WAN from <IPSpoof-LAN> to any
block in log quick on $WAN from <IPSpoof-WLAN> to any
block in log quick on $WAN from <IPSpoof-DMZ1> to any
block in log quick on $WAN from <IPSpoof-DMZ2> to any
block in log quick on $WAN from <IPSpoof-DMZ3> to any
block in log quick on ! $LAN from <IPSpoof-LAN> to any
block in log quick from ($LAN) to any
block in log quick on ! $WLAN from <IPSpoof-WLAN> to any
block in log quick from ($WLAN) to any
block in log quick on ! $DMZ1 from <IPSpoof-DMZ1> to any
block in log quick from ($DMZ1) to any
block in log quick on ! $DMZ2 from <IPSpoof-DMZ2> to any
block in log quick from ($DMZ2) to any
block in log quick on ! $DMZ3 from <IPSpoof-DMZ3> to any
block in log quick from ($DMZ3) to any
# INHERIT
pass out log quick from { ($WAN), ($LAN), ($WLAN), ($DMZ1) } to any keep state # vr: Allows the Firewall to talk to *
pass in log quick inet proto icmp from $INTERNET to ($WAN) icmp-type echoreq keep state # vr: WAN Interface Pingable
# ------------------------- POLICY ----------------------------
# LAN <> ANY
pass log quick inet proto icmp from <IPSpoof-LAN> to any icmp-type echoreq keep state # vr: ICMP/echo
pass log quick inet proto udp from <IPSpoof-LAN> to any port 33000><33999 keep state # vr: TRACEROUTE
# LAN <> WLAN
pass log from <IPSpoof-LAN> to <IPSpoof-WLAN> keep state # vr: Access WLAN
pass log inet proto tcp from <IPSpoof-WLAN> to 192.168.1.101 port 80 keep state # vr: Access to mythtv
# LAN <> WAN
pass log proto udp from <IPSpoof-LAN> to <DNS-Servers> port 53 keep state # vr: DNS
pass log from <IPSpoof-LAN> to $INTERNET keep state # vr: Internet Access for LAN
# LAN <> DMZ1
pass log from <IPSpoof-LAN> to <IPSpoof-DMZ1> keep state # vr: Access to DMZ1
# WLAN <> WAN
pass log proto udp from <IPSpoof-WLAN> to <DNS-Servers> port 53 keep state # vr: DNS
pass log from <IPSpoof-WLAN> to $INTERNET keep state # vr: Internet Access for WLAN
# FIREWALL
pass in log quick on $LAN proto tcp from <IPSpoof-LAN> to $LAN port 22 keep state # vr: SSH ACCESS FROM LAN
pass in log quick on $WAN proto tcp from $INTERNET to ($WAN) port 22 keep state # vr: SSH ACCESS FROM INTERNET
block in log quick to <firewall> # vr: BLOCK ACCESS TO ENFORCEMENT POINT