gaten

# pf.conf

## Macros
EXT="xl0"
INT="fxp0"
INT_IP="192.168.1.104"
WEBSERVER="192.168.1.101"
TCP_SERVICES="{ 22, 113 }"
ICMP_TYPES="echoreq"

## Tables

## Global Options
set loginterface $EXT
set block-policy return
set skip on lo
scrub in

## Queueing ruRules

## Translation Rules (NAT()

nat on $EXT from !($EXT) to any -> ($EXT)
rdr on $EXT proto tcp from any to any port 80 -> $WEBSERVER

## Filter Rules

# default deny
#block in
pass out keep state
antispoof quick for { lo }

pass in on $EXT inet proto tcp from any to ($EXT) \
        port $TCP_SERVICES flags S/SA keep state

pass in on $EXT inet proto tcp from any to $WEBSERVER port 80 \
        flags S/SA synproxy state

pass in inet proto icmp all icmp-type $ICMP_TYPES keep state

pass in quick on $INT