# Block those DDOS
#set limit { states 20000, frags 20000 }
# Optimize those packets!
set optimization aggressive
set block-policy return
ext_if="em0"
int_if="em1"
$int_if="81.216.72.0/24, 81.216.76.0/24"
#macro
TCP_OPTIONS = "flags S/SAFRUP keep state"
Games_tcp = "{ 6112:6119,3724,6667,28910,29900,29920,4711,16567 }"
Games_udp = "{ 29900,29901,29902,29903,29904,16567,55125,55123,55124 }"
# Only let ping in and out
#pass out on $ext_if inet proto icmp all icmp-type 8 code 0 keep state
#pass in on $ext_if inet proto icmp all icmp-type 8 code 0 keep state
# block all in
block in on $ext_if all
# silently drop broadcasts
block in quick on $ext_if from any to 255.255.255.255
# screw with nmap
block in log quick proto tcp flags FUP/WEUAPRSF
block in log quick proto tcp flags WEUAPRSF/WEUAPRSF
block in log quick proto tcp flags SRAFU/WEUAPRSF
block in log quick proto tcp flags /WEUAPRSF
block in log quick proto tcp flags SR/SR
block in log quick proto tcp flags SF/SF
# Games tcp
pass in quick on $ext_if inet proto tcp from any to ($ext_if) port $Games_tcp $TCP_OPTIONS
# Games udp
pass in quick on $ext_if inet proto udp from any to ($ext_if) port $Games_udp keep state
# outgoing UDP
pass out quick on $ext_if proto udp all keep state
# pass out all TCP connections
pass out quick on $ext_if proto tcp all keep state