# $FreeBSD: src/etc/pf.conf,v 1.2 2004/09/14 01:07:18 mlaier Exp $
# $OpenBSD: pf.conf,v 1.21 2003/09/02 20:38:44 david Exp $
#
# See pf.conf(5) and /usr/share/examples/pf for syntax and examples.
# Required order: options, normalization, queueing, translation, filtering.
# Macros and tables may be defined and used anywhere.
# Note that translation rules are first match while filter rules are last match.
# Macros: define common values, so they can be referenced and changed easily.
extif="tun0"
intif="nve0"
webox="192.168.0.100"
webox_port="10080"
tcp_services = "{ 20, 21, www, ssh, imap, imaps, 6667, 514 }"
intnet="192.168.0.0/24"
external_addr="nofxsbc.no-ip.org"
icmp_types = "echoreq"
allproto = "{ tcp, udp, ipv6, icmp, esp, ipencap }"
table <privnets> const { 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8, 0.0.0.0/8, 169.254.0.0/16, 192.0.2.0/24, 204.152.64.0/23, 224.0.0.0/3 }
torrents = "{ 6881, 6882, 6883, 6884, 6885, 6886, 6887, 6888, 6889 }"
set loginterface $extif
set block-policy return
set state-policy if-bound
set require-order yes
set debug misc
set fingerprints "/etc/pf.os"
set limit { frags 5000, states 2500, src-nodes 2000 }
set optimization normal
set timeout { interval 10, frag 30 }
set skip on lo0
# Normalizes packets and masks the OS's shortcomings such as SYN/FIN packets
# [scrub reassemble tcp](BID 10183) and sequence number approximation
# bugs (BID 7487).
scrub in on $extif all fragment reassemble min-ttl 15 max-mss 1400
scrub in on $extif all no-df random-id
scrub on $extif all reassemble tcp
# Nat rules
nat on $extif from $intnet to any -> $extif
rdr on $extif proto tcp from any to any port $webox_port -> $webox
#rdr on $extif proto tcp from any to any port 443 -> $webox
nat-anchor "ftp-proxy/*"
rdr-anchor "ftp-proxy/*"
rdr on $intif proto tcp from any to any port 21 -> 127.0.0.1 port 8021
block log
#pass quick on lo0 all
# block nmap's fingerprinting attempt(FIN, URG, PSH)
block in log quick on $extif inet proto tcp from any to any flags FUP/FUP
block in log quick on $extif inet proto tcp from any to any flags SF/SFRA
block in log quick on $extif inet proto tcp from any to any flags /SFRA
block in log quick on $extif inet proto tcp from any to any flags F/SFRA
block in log quick on $extif inet proto tcp from any to any flags U/SFRAU
block drop in log on $extif from <privnets> to any
block drop in log on $extif from any to <privnets>
block return in log quick on $extif proto { tcp, udp } from any to any port $tcp_services
pass quick inet proto { tcp, udp } from any to 64.34.228.0/24 keep state
pass in quick log on $extif proto tcp from any to any port $webox_port flags S/SA synproxy state
antispoof quick for $extif inet
pass in quick on $extif proto tcp from any to $extif port $torrents flags S/SA
pass in quick on $extif proto udp from any to $extif port $torrents
#pass in on $extif proto tcp from any to any port 443 flags S/SA synproxy state
pass in inet proto icmp all icmp-type $icmp_types keep state
pass out inet proto icmp all icmp-type $icmp_types keep state
pass out on $extif proto tcp from $intnet to any port $tcp_services modulate state flags S/SA
pass out on $extif proto { tcp, udp } all keep state
anchor "ftp-proxy/*"
pass in on $extif inet proto tcp from any to $extif user proxy keep state