# $OpenBSD: pf.conf,v 1.31 2006/01/30 12:20:31 camield Exp $
#
# See pf.conf(5) and /usr/share/pf for syntax and examples.
# Remember to set net.inet.ip.forwarding=1 and/or net.inet6.ip6.forwarding=1
# in /etc/sysctl.conf if packets are to be forwarded between interfaces.
ext_if="rl0"
int_if="xl0"
tcp_services="{ 21, 22, 25, 53, 80, 110, 113, 143, 220, 993, 995 }"
icmp_types="echoreq"
# options
set block-policy drop
set require-order yes
set fingerprints "/etc/pf.os"
set loginterface $ext_if
set limit { states 10000, frags 10000 }
# ignore local loopback
set skip on lo
# scrub
scrub in all
# nat
nat on $ext_if from !($ext_if) to any -> ($ext_if:0)
# Redirection (rdr) for forwarding from external IP to internal IP
rdr pass on $ext_if inet proto tcp from any to any port 3390 -> 192.168.1.100
rdr pass on $ext_if inet proto tcp from any to any port 3389 -> 192.168.1.250
rdr pass on $ext_if inet proto tcp from any to any port 54321 -> 192.168.1.251 port 22
# Default block rule for passing traffic on all attached interface
block in log all
block out log all
# Pass internal traffic freely
pass quick on $int_if all
# Pass external traffic with rules
pass out keep state
# Allow TCP/UDP services to the box via port #
pass in on $ext_if inet proto {udp tcp} from any to $ext_if \
port $tcp_services flags S/SA keep state
# Allow high TCP Ports for FTP
pass in on $ext_if inet proto tcp from any to $ext_if \
port > 49151 flags S/SA modulate state
# Allow ICMP basic network packets
pass in inet proto icmp all icmp-type $icmp_types keep state