# PF configuration for Central de Vendas Informatica LTDA.
# admin@centralinf.com.br
### macros ###
central_ext = "xl1"
central_ext_ip = "201.12.35.xx1"
central_int = "xl0"
central_int_net = "192.168.1.0/24"
central_ipsec = "201.12.35.xx3"
odin_int = "192.168.1.134"
odin_ext = "201.12.35.xx2"
saint_int = "192.168.1.53"
saint_ext = "201.12.35.54"
saint_net= "200.230.207.0/24"
sicredi_ext_ip = "201.77.95.20"
sicredi_net = "172.16.0.0/12"
### tables ###
table <ti> { 192.168.1.120, 192.168.1.121, 192.168.1.122, \
192.168.1.123, 192.168.1.124 }
table <orkut> { 72.14.209.85, 72.14.209.86, 72.14.209.87 }
### options ###
set loginterface $central_ext
set skip on lo
### scrub ###
scrub all no-df fragment reassemble random-id
### nat ###
# nat for all network.
nat on $central_ext from $central_int:network to any -> $central_ext:0
nat-anchor "ftp-proxy/*"
# binat for odin.
binat on $central_ext from $odin_int to any -> $odin_ext
# binat for saint.
binat on $central_ext from $saint_int to $saint_net -> $saint_ext
### redirects ###
# ftp-proxy.
rdr-anchor "ftp-proxy/*"
rdr pass on $central_int proto tcp to port ftp -> 127.0.0.1 port 8021
# transparent proxy.
rdr on $central_int proto tcp from any to any port http -> 127.0.0.1 port 3128
### filter rules ###
# block everything.
block log all
# antispoof and ftp-proxy anchor.
antispoof for $central_int inet
anchor "ftp-proxy/*"
# allow vpn (ipsec) from central to sicredi.
pass in proto esp from $sicredi_ext_ip to $central_ipsec
pass out proto esp from $central_ipsec to $sicredi_ext_ip
pass in on enc0 proto ipencap from $sicredi_ext_ip to $central_ipsec
pass in on enc0 from $sicredi_net to $central_int_net
pass out on enc0 from $central_int_net to $sicredi_net
pass in on $central_ext proto udp from $sicredi_ext_ip port = 500 to \
$central_ipsec port = 500
pass out on $central_ext proto udp from $central_ipsec port = 500 to \
$sicredi_ext_ip port = 500
# allow all traffic on $central_int.
pass on $central_int
# allow all traffic on tun (for pptp).
pass quick on tun
# allow orkut to <ti>.
pass in quick on $central_int inet proto tcp from <ti> to <orkut> \
port { http, https } modulate state flags S/SA
# block orkut.
block in quick on $central_int inet proto tcp from any to <orkut> \
port { http, https }
# allow msn to <ti>.
pass in quick on $central_int inet proto tcp from <ti> to any \
port 1863 modulate state flags S/SA
# block msn.
block in quick on $central_int inet proto tcp from any to any port 1863
# allow ping.
pass in quick inet proto icmp all icmp-type echoreq keep state
# allow vpn (pptp)
pass in quick on $central_ext inet proto tcp from any to $central_ext_ip \
port pptp modulate state flags S/SA
pass in quick on $central_ext inet proto gre from any to $central_ext_ip \
keep state
# allow dns.
pass in quick on $central_ext inet proto { tcp, udp } from any to $central_ext_ip \
port domain modulate state flags S/SA
# allow ftp and http to odin.
pass in quick on $central_ext inet proto tcp from any to $odin_int \
port { ftp, ftp-data, http, > 49151 } modulate state flags S/SA
# allow all tcp, udp and icmp pass out.
pass out quick on $central_ext inet proto { tcp, udp, icmp } all \
modulate state flags S/SA