# block everything.
block log all
pass in quick on $central_ext_ip proto tcp from any to any port 22
# antispoof and ftp-proxy anchor.
antispoof for $central_int inet
anchor "ftp-proxy/*"
# allow vpn (ipsec) from central to sicredi.
pass in proto esp from $sicredi_ext_ip to $central_ipsec
pass out proto esp from $central_ipsec to $sicredi_ext_ip
pass in on enc0 proto ipencap from $sicredi_ext_ip to $central_ipsec
pass in quick on enc0 from $sicredi_net to $central_int_net
pass out quick on enc0 from $central_int_net to $sicredi_net
pass in on $central_ext proto udp from $sicredi_ext_ip port = 500 to \
$central_ipsec port = 500
pass out on $central_ext proto udp from $central_ipsec port = 500 to \
$sicredi_ext_ip port = 500
# allow all traffic on $central_int.
pass on $central_int
# allow orkut to <ti>.
pass in quick on $central_int inet proto tcp from <ti> to <orkut> \
port { http, https } modulate state flags S/SA
# block orkut.
block drop in quick on $central_int inet proto tcp from any to <orkut> \
port { http, https }
# allow msn to <ti>.
pass in quick on $central_int inet proto tcp from <ti> to any \
port 1863 modulate state flags S/SA
# block msn.
block in quick on $central_int inet proto tcp from any to any port 1863
# allow ping.
pass in quick inet proto icmp all icmp-type echoreq keep state
# allow vpn (pptp)
pass quick on tun
pass in quick on $central_ext inet proto tcp from any to $central_ext_ip \
port pptp modulate state flags S/SA
pass in quick on $central_ext inet proto gre from any to $central_ext_ip \
keep state
# allow dns.
pass in quick on $central_ext inet proto udp from any to $central_ext_ip \
port domain keep state
# allow ftp and http to odin.
pass in quick on $central_ext inet proto tcp from any to $odin_int \
port { ftp, ftp-data, http, > 49151 } modulate state flags S/SA
# allow saint gobain XFB to come in.
pass in quick on $central_ext inet proto tcp from $saint_ext to $cam_int \
alemao p2p
pass in quick on $central_ext inet proto tcp from any to any \
port 18258 modulate state flags S/SA
pass in quick on $central_ext inet proto udp from any to any \
port 18262 keep state
# allow all tcp, udp and icmp pass out.
pass out quick on $central_ext inet proto { tcp, udp, icmp } all \
modulate state flags S/SA