# Packet filter ruleset
#
# =================================================================================
# macros
# =================================================================================
int_if = "tl0"
ext_if = "xl0"
wi_if = "ral0"
nat_ip = "82.69.182.61"
irc_ip = "82.69.182.60"
mail_ip = "82.69.182.59"
tcp_services = "{ 22, 113 }"
icmp_types = "echoreq"
allowed_out_tcp = "{ 20, 21, 25, 53, 80, 110, 443, 1863, 5190, 6665,6666,6667,6668 }"
allowed_out_udp = "{ 53 }"
priv_nets = "{ 192.168.123.0/24, 192.168.122.0/24, 127.0.0.0/8 }"
trusted_services = "{ some numbers in here }"
trusted_hosts = "secret"
table <blacklist> persist file "/etc/pf.blacklist"
# =================================================================================
# options
# =================================================================================
#set block-policy return
#set loginterface $ext_if
# scrub
scrub in all
# =================================================================================
# nat/rdr
# =================================================================================
nat on $ext_if from $int_if:network to any -> ($ext_if)
binat on $ext_if from 192.168.123.10 to any -> 82.69.182.60
binat on $ext_if from 192.168.123.11 to any -> 82.69.182.59
# Trusted services
rdr on $ext_if proto tcp from $trusted_hosts to any port $trusted_services -> 192.168.123.50
# =================================================================================
# filter rules
# =================================================================================
# Default rules
# ******************************************
# lo0 is a trusted interface (loopback)
# by default, block all incomming and outgoing traffic
# Also immediately block any blacklisted IP
pass quick on lo0 all
block in on $ext_if all
block in quick on $ext_if from <blacklist> to any
block out log on $ext_if all
block drop in quick on $ext_if from $priv_nets to any
block drop out quick on $ext_if from any to $priv_nets
# ************************************************
pass in log quick on $int_if proto tcp from $priv_nets to any port 22
pass in log quick on $ext_if proto tcp from $trusted_hosts to any port $trusted_services
# General network connectivity and natting
# ******************************************
pass in inet proto icmp all icmp-type $icmp_types keep state
pass in quick on $int_if from $int_if:network to any keep state
pass out quick on $int_if from any to $int_if:network keep state
pass out quick on $ext_if proto tcp from any to any port $allowed_out_tcp modulate state flags S/SA
pass out quick on $ext_if proto icmp all keep state
# pass out quick on $ext_if proto udp from any to any port $allowed_out_udp
pass out quick on $ext_if proto udp from any to any port $allowed_out_udp keep state
# pass out quick on $ext_if proto { udp, icmp } all keep state
# End of config
# .