########################################################
# macro definitions
#-------------------------------------------------------
ext_if="fxp0"
int_if="xl0"
wlan_if="wi0"
#-------------------------------------------------
# Options
#-------------------------------------------------
set skip on { lo $int_if $wlan_if }
set block-policy drop
scrub in
nat on $ext_if from !($ext_if) -> ($ext_if:0)
# Spamd whitelist table
table <spamd-white> persist
# Spamd and Postfix redirect on external interface. If in whitelist table go to Postfix.
# If not in whitelist table go to spamd.
rdr on $ext_if proto tcp from <spamd-white> to ($ext_if) port smtp -> lo0 port smtp
rdr on $ext_if proto tcp from !<spamd-white> to ($ext_if) port smtp -> lo0 port spamd
# Postfix Mail Server (internal interface) redirect for internal hosts.
rdr on $int_if proto tcp from { 192.168.1.105 127.0.0.1 } to $int_if port smtp -> lo0 port smtp
# Dovecot pop3s/imap Server (internal interface) redirect for internal hosts.
rdr on $int_if proto tcp from any to $int_if port imaps -> lo0 port imaps
#-------
# Set default policy
#------
block in log all
block out log all
#------------------------------------------------
# Anti-spoof rules
#------------------------------------------------
block in log quick on $wlan_if proto tcp from 192.168.2.200 to any port 25
pass out log on { $ext_if $int_if } modulate state
# Allow traffic for spamd from outside. Synproxy the connection.
pass in log quick on $ext_if inet proto tcp from any to lo0 port spamd flags S/SAFPRU synproxy state
# Allow traffic for postfix mail server from anyone on the outside and the inside.
pass in log on $ext_if inet proto tcp from any to lo0 port smtp flags S/SAFPRU synproxy state
# Allow traffic to Dovecot pop3 server from any network on the inside. Change to external if needed.
pass in log on $int_if inet proto tcp from any to lo0 port imaps flags S/SAFPRU keep state
# Allow ping of the firewall (including VIPs), easier to debug
pass in log quick inet proto icmp from any to self icmp-type echoreq keep state
pass in log on $ext_if inet proto tcp from any to any port 80 keep state
pass in log on $ext_if inet proto tcp from any to any port 25 keep state