# set some variables
ext_if="fxp0"
int_if="fxp1"
state_if="fxp2"
mgmt_if="fxp3"
#### Firewall Networks
spamd = "192.168.1.36"
unigold_175 = "103.88.46.175/32"
unigold_176 = "103.88.46.176/32"
##OPTIONS##
###### OPTIONS #####
## timeouts
set timeout tcp.first 120
set timeout tcp.opening 30
set timeout tcp.established 86400
set timeout tcp.closing 900
set timeout tcp.finwait 45
set timeout tcp.closed 90
set timeout udp.first 60
set timeout udp.single 30
set timeout udp.multiple 60
set timeout icmp.first 20
set timeout icmp.error 10
set timeout other.first 60
set timeout other.single 30
set timeout other.multiple 60
set timeout frag 30
set timeout interval 10
set timeout adaptive.start 0
set timeout adaptive.end 0
set timeout src.track 0
set timeout interval 5
set timeout frag 20
set limit { states 50000, frags 50000 }
set block-policy drop
set optimization normal
set state-policy if-bound
set require-order yes
scrub in all no-df random-id
scrub out all no-df random-id max-mss 1460
#scrub in all
## Spamd Stuff
# Table that spamd updates
# grey host list
table <spamd> persist
# white host lists
table <spamd-white> persist
# This whitelist we are manually maintaining.
table <whitelist> persist file "/etc/whitelist.txt"
rdr on $ext_if proto tcp from !<whitelist> to any port smtp -> 127.0.0.1 port 8025
pass in on $ext_if route-to lo0 proto tcp from any to 127.0.0.1 port 8025
#-----------------------------#
#------ Anti-spoofing --------#
#
#antispoof for lo0
#block by default
block in log all
#block in quick on the following request.
block in log quick proto tcp flags FUP/WEUAPRSF
block in log quick proto tcp flags WEUAPRSF/WEUAPRSF
block in log quick proto tcp flags SRAFU/WEUAPRSF
block in log quick proto tcp flags /WEUAPRSF
block in log quick proto tcp flags SR/SR
block in log quick proto tcp flags SF/SF
block in log quick proto tcp from {$bad_ip} to any
#ignore everything on these interfaces
pass quick on pfsync0 proto pfsync
pass quick on $state_if proto pfsync
pass quick on $int_if all modulate state
pass quick on $mgmt_if all modulate state
### LOOPBACK
pass in quick on lo0 all
pass out quick on lo0 all
# out on ext_if
pass out on $ext_if proto { tcp, udp, icmp } all modulate state
# out on state_if
pass out on $state_if proto { tcp, udp, icmp } all modulate state
### Unigold SSH configuration
# Allowed incoming tcp service (ssh)
pass in on $ext_if proto tcp from any to $unigold_175 port \
{ 22 } \
flags S/SA keep state
pass in on $ext_if proto tcp from any to $unigold_176 port \
{ 22, 8443, 45665 } \
flags S/SA keep state