ext_if="fxp0"
int_if="vr0"
hp="{ 192.6.144.0/20, 192.6.160.0/19, 192.6.192.0/18, 15.0.0.0/8 }"
# EXT
## deb = vnc, www, mysql
## lautaro = mail
## mail =
## open = dns, ssh
ip_net1="201.236.83.146" # dns, nat
ip_net2="201.236.83.147" # ftp, db
ip_net3="201.236.83.148" # mail<OLD
ip_net4="201.236.83.149" # www
ip_net5="201.236.83.150" # mail, ssh 10022
# INT
ip_obsd="192.168.0.1"
ip_fresia="192.168.0.2"
ip_deb="192.168.0.3"
ip_lautaro="192.168.0.4"
# PORTS
# gl ut gl svn my vnc pg
deb_ports="{ 60000:65535 50000 59999 3690 3306 5900 5432 80 22 }"
deb_ports_udp="{ 7777 7778 7787 7788 }"
fresia_ports="{ 21 80 443 60000:65000 }"
obsd_ports="{ 53 22 32256 }"
obsd_ports_udp="{ 53 }"
lautaro_ports="{ 25 110 }"
# TABLAS
table <BUGS> persist file "/etc/pf/BUGS"
table <LAN> persist file "/etc/pf/LAN"
table <PROXY> persist file "/etc/pf/PROXY"
table <LANBUG> persist
# SETS
set timeout { interval 10, frag 30 }
set timeout { tcp.first 120, tcp.opening 30, tcp.established 86400 }
set timeout { tcp.closing 900, tcp.finwait 45, tcp.closed 90 }
set timeout { udp.first 60, udp.single 30, udp.multiple 60 }
set timeout { icmp.first 20, icmp.error 10 }
set timeout { other.first 60, other.single 30, other.multiple 60 }
set timeout { adaptive.start 0, adaptive.end 0 }
set limit { states 10000, frags 5000 }
set optimization aggressive
set block-policy drop
set require-order yes
scrub in all
scrub all random-id
scrub all reassemble tcp
# RDR
rdr on $ext_if proto { tcp,udp } from any to $ip_net1 port 53 -> $ip_obsd
#rdr on $ext_if proto tcp from any to $ip_net2 port 3306 -> $ip_deb
rdr on $ext_if proto tcp from any to $ip_net2 port 5432 -> $ip_deb
rdr on $ext_if proto tcp from any to $ip_net2 port 21 -> $ip_fresia
rdr on $ext_if proto tcp from any to $ip_net2 port 60000:65000 -> $ip_fresia
rdr on $ext_if proto tcp from any to $ip_net3 port 25 -> $ip_lautaro
rdr on $ext_if proto tcp from any to $ip_net5 port 25 -> $ip_lautaro
rdr on $ext_if proto tcp from any to $ip_net3 port 110 -> $ip_lautaro
rdr on $ext_if proto tcp from any to $ip_net5 port 110 -> $ip_lautaro
rdr on $ext_if proto tcp from any to $ip_net4 port 80 -> $ip_fresia
rdr on $ext_if proto tcp from any to $ip_net5 port 10022 -> $ip_obsd port 22
#rdr on $ext_if proto tcp from any to $ip_net5 port 5900 -> $ip_deb
rdr on $ext_if proto tcp from any to $ip_net5 port 3690 -> $ip_deb
rdr on $ext_if proto tcp from any to $ip_net5 port 32256 -> $ip_obsd
rdr on $ext_if proto tcp from any to $ip_net5 port 59999:65535 -> $ip_deb
#squid
# rdr on $int_if inet proto tcp from <PROXY> to any port 80 -> 127.0.0.1
# port 3128
# ut
rdr on $ext_if proto tcp from any to $ip_net5 port 50000 -> $ip_deb
rdr on $ext_if proto udp from any to $ip_net5 port $deb_ports_udp -> $ip_deb
#rdr on $ext_if proto tcp from any to $ip_net4 port $lautaro_ports -> $ip_lautaro
#rdr on $int_if proto tcp from any to 192.168.0.4 -> 192.168.0.3 port 3128
#rdr on $int_if inet proto tcp from 192.168.0.2 to any port 80 -> 192.168.0.3 port 3128
# NAT
nat on $ext_if from $ip_deb to any -> $ip_net4
nat on $ext_if from $ip_fresia to any -> $ip_net2
nat on $ext_if from $ip_lautaro to any -> $ip_net5
nat on $ext_if from <LAN> to any -> $ip_net1
# antispoof
antispoof for $int_if
antispoof for lo0
# filtros
block in on $ext_if all
block in quick on $ext_if proto tcp from any to any flags /S
block in quick on $ext_if proto tcp from any to any flags /SFRA
block in quick on $ext_if proto tcp from any to any flags /SFRAU
block in quick on $ext_if proto tcp from any to any flags A/A
block in quick on $ext_if proto tcp from any to any flags F/SFRA
block in quick on $ext_if proto tcp from any to any flags U/SFRAU
block in quick on $ext_if proto tcp from any to any flags SF/SF
block in quick on $ext_if proto tcp from any to any flags SF/SFRA
block in quick on $ext_if proto tcp from any to any flags SR/SR
block in quick on $ext_if proto tcp from any to any flags FUP/FUP
block in quick on $ext_if proto tcp from any to any flags FUP/SFRAUPEW
block in quick on $ext_if proto tcp from any to any flags SFRAU/SFRAU
block in quick on $ext_if proto tcp from any to any flags SFRAUP/SFRAUP
block in quick on $ext_if proto tcp all flags FUP/FUP
block in quick on $ext_if proto igmp from any to any
block in log quick on $ext_if from any os NMAP
block in quick on $ext_if from any os unknow
block in log quick on $ext_if proto { tcp, udp } from <BUGS> to any
#testing
block in log quick on $int_if proto { tcp, udp } from any to <BUGS>
pass out log keep state
pass in log on $ext_if proto icmp from any to any
pass in log on { $int_if, lo0 } all
pass out log on { $int_if, lo0 } all keep state
#block out on $int_if proto tcp from <LAN_NOLET> to any
#pass out on $int_if proto tcp from <LAN_NOLET> to any port { 80 21 } keep state
pass in log on $ext_if proto tcp from any to $ip_fresia port $fresia_ports flags S/SA keep state
pass in log on $ext_if proto tcp from any to $ip_fresia port 80 flags S/SA synproxy state
pass in log on $ext_if proto tcp from any to $ip_deb port $deb_ports flags S/SA keep state
pass in log on $ext_if proto udp from any to $ip_deb port $deb_ports_udp keep state
pass in log on $ext_if proto tcp from any to $ip_obsd port $obsd_ports flags S/SA keep state
pass in log on $ext_if proto udp from any to $ip_obsd port $obsd_ports_udp modulate state
pass in log on $ext_if proto tcp from any to $ip_lautaro port $lautaro_ports flags S/SA keep state
# Esta bloqueaba el FTP de hp.com
# block in log quick on $int_if proto { tcp, udp } from <PROXY> to any port > 3129
#block in log quick on $int_if proto { tcp, udp } from <LANBUG> to any
#pass in log quick on $int_if proto { tcp, udp } from <PROXY> to $hp
#block in log on $int_if proto { tcp, udp } from <PROXY> to any port > 3129
#block in log quick on $int_if proto { tcp, udp } from 192.168.0.2 to any port > 80
#pass in on $int_if proto tcp from any to 192.168.0.3 port 3128 keep state
#pass in quick log on $ext_if proto tcp from any to any port ssh flags S/SA modulate state \
#(max-src-conn 3, max-src-conn-rate 2/60 overload <bugs> flush global)