root@amazonas# cat pf.conf
### Interfaces
if_wan = "sis0"
if_dmz = "xl0"
if_anca = "xl1"
if_bdf = "xl2"
if_all = "{" $if_wan $if_dmz $if_anca $if_bdf "}"
### Networks
...
### Hosts
# Firewall's Hosts
table <firewall> const { self }
...
# Local Hosts
...
# Remote Hosts
....
### Protocols
proto_all = "{ tcp, udp, icmp }"
### Groups
trusted1 = "{" $host_weber $host_ancabsb "}"
trusted2 = "{" $host_weber "}"
host_avg_all = "{" $host_avg1 $host_avg2 "}"
host_voip_all = "{" $host_voipgvt $host_voipstelecom $host_voipfwd1 $host_voipfwd2 "}"
set loginterface $if_wan
scrub in on $if_wan all
# queue: destino_origem_{tipo}
altq on $if_wan cbq bandwidth 1.0Mb queue { inet_std, inet_dmz }
altq on $if_anca cbq bandwidth 100Mb queue { anca_inet, anca_internal }
altq on $if_bdf cbq bandwidth 100Mb queue { bdf_inet, bdf_internal }
altq on $if_dmz cbq bandwidth 100Mb queue { dmz_inet, dmz_internal }
queue inet_std bandwidth 500Kb cbq(default)
queue inet_dmz bandwidth 500Kb priority 1 cbq { inet_dmz_std, inet_dmz_mail, inet_dmz_voip }
queue inet_dmz_std bandwidth 50Kb cbq
queue inet_dmz_mail bandwidth 400Kb priority 2 cbq
queue inet_dmz_voip bandwidth 50Kb priority 3 cbq
queue anca_inet bandwidth 250Kb cbq(default)
queue anca_internal bandwidth 99Mb cbq
queue bdf_inet bandwidth 250Kb cbq(default)
queue bdf_internal bandwidth 99Mb cbq
queue dmz_inet bandwidth 500Kb priority 1 cbq { dmz_inet_std, dmz_inet_mail, dmz_inet_voip }
queue dmz_inet_std bandwidth 50Kb cbq(default)
queue dmz_inet_mail bandwidth 400Kb priority 2 cbq
queue dmz_inet_voip bandwidth 50Kb priority 3 cbq
queue dmz_internal bandwidth 99Mb cbq
nat on $if_wan from $if_anca:network to any -> ($if_wan)
nat on $if_wan from $if_bdf:network to any -> ($if_wan)
pass quick on lo0 all
antispoof log quick for $if_wan inet
antispoof log quick for $if_dmz inet
antispoof log quick for $if_anca inet
antispoof log quick for $if_bdf inet
### trafego udp entre tapajos e madeira - p/ politica de backup
pass in quick on $if_dmz proto udp from $host_tapajos to $host_madeira queue bdf_internal
pass out quick on $if_bdf proto udp from $host_tapajos to $host_madeira queue bdf_internal
pass in quick on $if_bdf proto udp from $host_madeira to $host_tapajos queue dmz_internal
pass out quick on $if_dmz proto udp from $host_madeira to $host_tapajos queue dmz_internal
### trafego udp entre tapajos e xingu - p/ politica de backup
pass in quick on $if_dmz proto udp from $host_tapajos to $host_xingu queue anca_internal
pass out quick on $if_anca proto udp from $host_tapajos to $host_xingu queue anca_internal
pass in quick on $if_anca proto udp from $host_xingu to $host_tapajos queue dmz_internal
pass out quick on $if_dmz proto udp from $host_xingu to $host_tapajos queue dmz_internal
### trafego de tapajos para internet - libera trafego
pass in quick on $if_dmz proto $proto_all from $host_tapajos to any modulate state queue dmz_inet_std
pass out quick on $if_wan proto $proto_all from $host_tapajos to any modulate state queue dmz_inet_std
### trafego entre uatuma e provedores voip - prioridade maxima
pass in quick on $if_dmz proto $proto_all from $host_uatuma to $host_voip_all queue inet_dmz_voip
pass out quick on $if_wan proto $proto_all from $host_uatuma to $host_voip_all queue inet_dmz_voip
pass in quick on $if_wan proto $proto_all from $host_voip_all to $host_uatuma queue dmz_inet_voip
pass out quick on $if_dmz proto $proto_all from $host_voip_all to $host_uatuma queue dmz_inet_voip
### trafego entre uatuma e rede anca
pass in quick on $if_anca proto $proto_all from $net_anca to $host_uatuma queue dmz_internal
pass out quick on $if_dmz proto $proto_all from $net_anca to $host_uatuma queue dmz_internal
pass in quick on $if_dmz proto $proto_all from $host_uatuma to $net_anca queue anca_internal
pass out quick on $if_anca proto $proto_all from $host_uatuma to $net_anca queue anca_internal
### trafego entre uatuma e rede bdf
pass in quick on $if_bdf proto $proto_all from $net_bdf to $host_uatuma queue dmz_internal
pass out quick on $if_dmz proto $proto_all from $net_bdf to $host_uatuma queue dmz_internal
pass in quick on $if_dmz proto $proto_all from $host_uatuma to $net_bdf queue bdf_internal
pass out quick on $if_bdf proto $proto_all from $host_uatuma to $net_bdf queue bdf_internal
### trafego de uatuma para internet
pass in quick on $if_dmz proto $proto_all from $host_uatuma to any modulate state queue inet_dmz_std
pass out quick on $if_wan proto $proto_all from $host_uatuma to any modulate state queue inet_dmz_std
### trafego de trusted1 para uatuma
pass in quick on $if_wan proto tcp from $trusted1 to $host_uatuma port 80 modulate state queue dmz_inet_std
pass out quick on $if_dmz proto tcp from $trusted1 to $host_uatuma port 80 modulate state queue dmz_inet_std
### trafego entre solimoes e rede anca
pass in quick on $if_anca proto tcp from $net_anca to $host_solimoes port { 25, 80 } queue dmz_internal
pass out quick on $if_dmz proto tcp from $net_anca to $host_solimoes port { 25, 80 } queue dmz_internal
pass in quick on $if_dmz proto tcp from $host_solimoes port { 25, 80 } to $net_anca queue anca_internal
pass out quick on $if_anca proto tcp from $host_solimoes port { 25, 80 } to $net_anca queue anca_internal
### trafego entre solimoes e rede bdf
pass in quick on $if_bdf proto tcp from $net_bdf to $host_solimoes port { 25, 80 } queue dmz_internal
pass out quick on $if_dmz proto tcp from $net_bdf to $host_solimoes port { 25, 80 } queue dmz_internal
pass in quick on $if_dmz proto tcp from $host_solimoes port { 25, 80 } to $net_bdf queue bdf_internal
pass out quick on $if_bdf proto tcp from $host_solimoes port { 25, 80 } to $net_bdf queue bdf_internal
### trafego entre solimoes e internet
pass in quick on $if_dmz proto tcp from $host_solimoes to any port 25 modulate state queue inet_dmz_mail
pass out quick on $if_wan proto tcp from $host_solimoes to any port 25 modulate state queue inet_dmz_mail
pass in quick on $if_wan proto tcp from any to $host_solimoes port { 25, 80 } queue dmz_inet_mail
pass out quick on $if_dmz proto tcp from any to $host_solimoes port { 25, 80 } queue dmz_inet_mail
pass in quick on $if_dmz proto $proto_all from $host_solimoes to any modulate state queue inet_dmz_std
pass out quick on $if_wan proto $proto_all from $host_solimoes to any modulate state queue inet_dmz_std
### trafego do firewall para outras redes
pass out quick on $if_anca proto $proto_all from <firewall> to $net_anca modulate state queue anca_internal
pass out quick on $if_bdf proto $proto_all from <firewall> to $net_bdf modulate state queue bdf_internal
pass out quick on $if_dmz proto $proto_all from <firewall> to $net_dmz modulate state queue dmz_internal
pass out quick on $if_wan proto $proto_all from <firewall> to any modulate state queue inet_std
### trafego da internet para o firewall
pass in quick log on $if_wan proto tcp from any to $host_fw_wan port 22 modulate state queue inet_std
### trafego de redes/hosts confiaveis para o firewall
pass in quick log on $if_wan proto tcp from $trusted1 to $host_fw_wan port { 80, 10000 } modulate state queue inet_std
pass in quick log on $if_wan proto tcp from $trusted2 to $host_fw_wan port 1241 modulate state queue inet_std
### bloqueia trafego na interface DMZ
block quick on $if_dmz
### trafego da rede anca para firewall
pass in quick on $if_anca proto udp from $net_anca to $host_fw_anca port { 53, 67 } modulate state queue anca_internal
pass in quick on $if_anca proto tcp from $net_anca to $host_fw_anca port { 22, 80, 3128 } modulate state queue anca_internal
### trafego da rede anca para internet
pass in quick on $if_anca proto tcp from $net_anca to any port { 25, 110, 143 } modulate state queue inet_std
### trafego da rede anca para AVG
pass in quick on $if_anca proto $proto_all from $net_anca to $host_avg_all modulate state queue inet_std
### bloqueia trafego de xingu para outras redes
block in quick on $if_anca proto $proto_all from $host_xingu to { $net_dmz, $net_bdf }
### trafego de xingu para internet
pass in quick on $if_anca proto $proto_all from $host_xingu to any modulate state queue inet_std
### trafego especifico da rede
pass in quick on $if_anca proto tcp from { $host_maira $host_cris } to { $host_webmst $host_webmstlocaweb } modulate state queue inet_std
pass in quick on $if_anca proto tcp from $host_felipenotebook to any port { 22, 6667 } modulate state queue inet_std
pass in quick on $if_anca proto tcp from $host_zenaide to $host_fw_wan port 10000 modulate state queue anca_internal
### bloqueia trafego na interface ANCA
block quick on $if_anca
### trafego da rede bdf para firewall
pass in quick on $if_bdf proto udp from $net_bdf to $host_fw_bdf port { 53, 67 } modulate state queue bdf_internal
pass in quick on $if_bdf proto tcp from $net_bdf to $host_fw_bdf port { 22, 80, 3180 } modulate state queue bdf_internal
### trafego da rede bdf para internet
pass in quick on $if_bdf proto tcp from $net_bdf to any port { 25, 110, 143 } modulate state queue inet_std
### trafego da rede bdf para AVG
pass in quick on $if_bdf proto $proto_all from $net_bdf to $host_avg_all modulate state queue inetd_std
### bloqueia trafego de madeira para outras redes
block in quick on $if_bdf proto $proto_all from $host_madeira to { $net_dmz, $net_anca }
### trafego de madeira para internet
pass in quick on $if_bdf proto $proto_all from $host_madeira to any modulate state queue inet_std
### trafego especifico da rede
pass in quick on $if_bdf proto tcp from $host_macdiagramacao to any port { 80, 443 } modulate state queue inet_std
pass in quick on $if_bdf proto tcp from $host_niltonviana to $host_gazetamercantil modulate state queue inet_std
pass in quick on $if_bdf proto tcp from $host_jorgeosoris to { $host_webbdf $host_iespana $host_jubileubrasil } modulate state queue inet_std
pass in quick on $if_bdf proto tcp from $host_edmilson to $host_fw_wan port 10000 modulate state queue bdf_internal
### bloqueia trafego na interface BDF
block quick on $if_bdf
### bloqueia tudo
block quick all
root@amazonas#