# MACROS AND DEFINITIONS
ext_if="vr0"
int_if="dc0"
tcp_services = "{ ftp, ssh, domain, http, pop3, imap, auth, pop3s }"
udp_services = "{ domain, ntp }"
Ori = "{ 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8, 169.254.0.0/16, 192.0.2.0/24, 0.0.0.0/8, 240.0.0.0/4 }"
omg_hax = "{ 135, 139, 445 }"
good_icmp = "{ echoreq, unreach }"
scelestus = "192.168.0.187"
lilith = "192.168.0.2"
finalpc = "192.168.0.3"
marianne = "192.168.0.5"
scelestus_ports = "{ ftp, http, https, domain }"
lilith_ports = "{ 10000:19999, auth }"
finalpc_ports = "20000:29999"
marianne_ports = "30000:39999"
table <haxors> persist
# OPTIONS
set skip on lo0
set block-policy drop
# NORMALIZATION
scrub in all
scrub on $ext_if all random-id reassemble tcp
# QUEUEING
# I'm assuming you're only interested in shaping your outgoing/upload bandwidth.
# If you're interested in shaping incoming/download bandwidth, then you will need
# altq enabled on the internal interface.
#
# Unless you have 100Mb upload from your isp (I'm assuming your $ext_if is connected
# to an isp), that 100Mb value is probably WAAAAY too large. The total bandwidth
# alloted to the queues on the interface should not exceed the upload bandwidth.
# In fact, it should be less (perhaps around 80% of your upload) to allow for
# protocol overhead. (If you do set up altq on $int_if, that one can and should
# have a much higher value in keeping with your internal network's bandwidth.)
#
# Keep in mind that queueing only works on outbound traffic. cheggit the second
# paragraph of http://www.openbsd.org/faq/pf/queueing.html and http://www.benzedrine.cx/ackpri.html
# for some good info on queueing.
altq on $ext_if cbq bandwidth 100Mb queue { lilith, finalpc, ssh, other, synack }
queue lilith bandwidth 3Mb cbq(borrow red)
queue finalpc bandwidth 3Mb cbq(borrow red)
queue ssh bandwidth 1Mb cbq(borrow red) { ssh_interactive, ssh_bulk }
queue other bandwidth 1Mb cbq(default borrow red)
queue synack bandwidth 1Mb cbq(borrow red) priority 7
queue ssh_interactive bandwidth 256Kb cbq(borrow red) priority 6
queue ssh_bulk bandwidth 256Kb cbq(borrow red) priority 1
# TRANSLATION
nat pass on $ext_if from $int_if:network to any -> ($ext_if)
# If $scelestus_ports, $lilith_ports, $finalpc_ports, $marianne_ports only accept incoming
# tcp connections, then it would be best to remove udp from these rules.
rdr on $ext_if proto { tcp, udp } from any to ($ext_if) port $scelestus_ports -> $scelestus
rdr on $ext_if proto { tcp, udp } from any to ($ext_if) port $lilith_ports -> $lilith
rdr on $ext_if proto { tcp, udp } from any to ($ext_if) port $finalpc_ports -> $finalpc
rdr on $ext_if proto { tcp, udp } from any to ($ext_if) port $marianne_ports -> $marianne
# FILTERING
block all
block in quick on $ext_if from <haxors> to any
block in quick on $ext_if from any to any port $omg_hax
block in quick on $ext_if from $Ori to any
block out quick on $ext_if from any to $Ori
antispoof quick for $ext_if
antispoof quick for $int_if
# Because of block all, we need to specifically allow for traffic to traverse the internal interface.
pass in quick on $int_if from $int_if:network to any keep state
pass out quick on $int_if from any to $int_if:network keep state
# It wasn't possible to make out from your original ruleset which hosts were
# running sshd, so I assumed that external ssh connections are only allowed
# to the firewall itself. If that assumption is erroneous, modify the following
# rule to suit your needs. But it seems a reasonable supposition given the
# absence of ssh ports in the rdr rules.
pass in log quick on $ext_if inet proto tcp from any to ($ext_if) port ssh flags S/SA keep state (max-src-conn 15, max-src-conn-rate 5/3, overload <haxors> flush global) queue (ssh_bulk, ssh_interactive)
pass out log quick on $ext_if inet proto tcp from any to any port 22 flags S/SA keep state queue (ssh_bulk, ssh_interactive)
# You didn't have any pass rules specific to $scelestus and $marianne. I added them to the following
# two groups of rules on $ext_if. I assumed you would want that since you have rdr rules set up
# for those hosts. If that's not the case, simply delete or comment out.
pass in quick on $ext_if proto { tcp, udp } from any to $lilith port $lilith_ports keep state queue lilith
pass in quick on $ext_if proto { tcp, udp } from any to $finalpc port $finalpc_ports keep state queue finalpc
pass in quick on $ext_if proto { tcp, udp } from any to $scelestus port $scelestus_ports keep state
pass in quick on $ext_if proto { tcp, udp } from any to $marianne port $marianne_ports keep state
pass in quick on $ext_if proto { tcp, udp } from any to ($ext_if) keep state queue synack
pass out quick on $ext_if proto { tcp, udp } from $lilith to any keep state queue lilith
pass out quick on $ext_if proto { tcp, udp } from $finalpc to any keep state queue finalpc
pass out quick on $ext_if proto { tcp, udp } from $scelestus to any keep state
pass out quick on $ext_if proto { tcp, udp } from $marianne to any keep state
pass out quick on $ext_if proto { tcp, udp } from ($ext_if) to any keep state queue synack
pass out quick on $ext_if proto icmp all keep state queue synack
pass out on $ext_if proto { tcp, udp } all keep state