# PF configuration for Central de Vendas Informatica LTDA.
# macros
ext_if = ""
int_if = ""
int_tomcat = "192.168.1.134"
ext_tomcat = "201.12.35.52"
priv_nets = "{ 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 }"
tcp_services = "{ 20, 21, 80, 443, 1723 }"
icmp_types = "echoreq"
# options
set block-policy return
set loginterface $ext_if
# scrub
scrub in all fragment reassemble
# nat
nat on $ext_if from $int_if:network to any -> ($ext_if)
rdr on $int_if proto tcp from any to any port 21 -> 127.0.0.1 \
port 8021
# filter
block all
pass quick on lo0 all
block drop in quick on $ext_if from $priv_nets to any
block drop out quick on $ext_if from any to $priv_nets
block drop quick proto tcp from any to any port 1863
pass in inet proto icmp all icmp-type $icmp_types keep state
pass in on $ext_if inet proto tcp from any to ($ext_if) \
port $tcp_services flags S/SA keep state
pass out on $ext_if proto tcp all modulate state flags S/SA
pass out on $ext_if proto { udp, icmp } all keep state