#################################################################
# macro definitions
ext_if = "rl0"
int_if = "rl1"
crew_if = "rl2"
int_net = "192.168.40.0/24"
nat_p = "{tcp, udp, icmp}"
icmp_types = "echoreq"
services = "{ ssh, domain }"
#out_tcp = "{ 20:23, 25, 53, 80, 110, 113, 143, 443, 500, 873, 989:995, 1400:1600, 3724, 6112, 6881:6999, 6667:6669, 7000, 8080, 8888, 27000:27030, 38030, 38040 }"
#out_udp = "{ 20:23, 25, 53, 80, 110, 113, 143, 443, 500, 525, 873, 992:995, 3724, 8080 }"
no_go_ip = "{ 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12}"
###############################################################################
# options: "set"
set loginterface rl0
set loginterface rl1
set loginterface rl2
set limit { frags 30000, states 25000 }
set fingerprints "/etc/pf.os"
###############################################################################
# scrub rules: "scrub"
scrub in on $ext_if all fragment reassemble
###############################################################################
# altq rules: "altq", "queue"
#altq on $ext_if bandwidth 8Mb queue { std, ssh, web, gaming, irc}
#
#queue std bandwidth 1Mb cbq(default)
#queue ssh bandwidth 1Mb { ssh_login, ssh_bulk }
# queue ssh_login bandwidth 25% priority 5 cbq(ecn)
# queue ssh_bulk bandwidth 75% priority 5 cbq(ecn)
#queue gaming bandwidth 4Mb priority 4 cbq(ecn)
#queue irc bandwidth 1Mb priority 3 cbq(borrow red)
#queue web bandwidth 2Mb priority 2 cbq(borrow red)
#altq on $ext_if priq bandwidth 450Kb queue { q_pri, q_def }
#queue q_def priq(default)
#queue q_pri priority 7
###############################################################################
# NAT rules: "rdr", "nat", "binat"
nat on $ext_if proto $nat_p from $int_net to any -> ($ext_if)
###############################################################################
# tables
table <badips> persist file "/etc/pf.badips"
#################################################################
# filtering rules: "antispoof", "block", "pass"
# block and log everything by default
block out log on $ext_if all label logall-tcp-out
block in log on $ext_if all label logall-tcp-in
block return-rst out log on $ext_if proto tcp all
block return-rst in log on $ext_if proto tcp all
block return-icmp out log on $ext_if proto udp all
block return-icmp in log on $ext_if proto udp all
# antispoofing stuff
# silently drop broadcasts (cable modem noise)
block in log quick on $ext_if from any to 255.255.255.255 label noise
# block and log incoming packets from reserved address space and invalid
# addresses, they are either spoofed or misconfigured, we can't reply to
# them anyway (hence, no return-rst).
block in log on $ext_if inet from $no_go_ip to ($ext_if) label nogoip
block out log on $ext_if inet from any to $no_go_ip label nogoip
# block packets from IP addresses in the /etc/pf.badips file
block drop in log quick on $ext_if from <badips> to ($ext_if) label badips
# ICMP
# pass out/in certain ICMP queries and keep state (ping)
# state matching is done on host addresses and ICMP id (not type/code),
# so replies (like 0/0 for 8/0) will match queries
# ICMP error messages (which always refer to a TCP/UDP packet) are
# handled by the TCP/UDP states
pass out on $ext_if inet proto icmp all icmp-type 8 code 0 keep state label icmp-type-8
# UDP
# Pass out traffic on allowed udp ports, and keep state
pass out on $ext_if inet proto udp all keep state
#pass out on $ext_if inet proto udp from any to any port $out_udp keep state
# pass in certain UDP connections and keep state (DNS)
pass in on $ext_if proto udp from any to any port domain keep state
# TCP
# Pass out traffic on allowed tcp ports, and keep modulate state
pass out on $ext_if inet proto tcp all flags S/SA modulate state
#pass out on $ext_if inet proto tcp from any to any port $out_tcp flags S/SA modulate state
# pass in certain TCP connections and keep state
pass in on { $ext_if, $int_if } proto tcp from any to any port $services flags S/SA keep state
# allow all on internal
pass out on $int_if all