# Macros:
ext_if = "tun0"
int_if = "txp0"
ssh_ports = "{ 22 2022 }"
im_ports = "{ 1863 5190 5222 }"
###########
# OPTIONS #
###########
# expire state connections early
set optimization aggressive
set timeout { udp.first 45, udp.single 20, udp.multiple 45 }
set timeout { tcp.first 100, tcp.opening 25, tcp.established 1800 }
set timeout { tcp.closing 750, tcp.finwait 40, tcp.closed 80 }
set loginterface $ext_if
############
# QUEUEING #
############
# enable queueing on the external interface to control traffic going to
# the Internet. use the priq scheduler to control only priorities. set
# the bandwidth to 770Kbps to get the best performance out of the TCP
# ACK queue.
altq on $ext_if priq bandwidth 700Kb queue { std_out, ssh_im_out, dns_out, tcp_ack_out }
# define the parameters for the child queues.
# std_out - the standard queue. any filter rule below that does not
# explicitly specify a queue will have its traffic added
# to this queue.
# ssh_im_out - interactive SSH and various instant message traffic.
# dns_out - DNS queries.
# tcp_ack_out - TCP ACK packets with no data payload.
queue std_out priq(default)
queue ssh_im_out priority 4 priq(red)
queue dns_out priority 5
queue tcp_ack_out priority 7
#############
# NAT Rules #
#############
# translate lan client addresses to that of ext_if
nat on $ext_if from 10.10.0.0/24 to any -> ($ext_if)
####################
# Redirection Rule #
####################
## Remote Desktop / Remote Assistance ##
rdr on $ext_if proto tcp from any to any port 3389 -> 10.10.0.6
#rdr on $ext_if proto tcp from any to any port 3389 -> 10.10.0.3
## Bittorent USER A ##
rdr on $ext_if proto tcp from any to any port 6881 -> 10.10.0.3
rdr on $ext_if proto udp from any to any port 6881 -> 10.10.0.3
## Bittorent USER B ##
rdr on $ext_if proto tcp from any to any port 7881 -> 10.10.0.5
rdr on $ext_if proto udp from any to any port 7881 -> 10.10.0.5
## Nintendo Wifi USB ##
rdr on $ext_if proto tcp from any to any port 28910 -> 10.10.0.5
rdr on $ext_if proto tcp from any to any port 29900 -> 10.10.0.5
rdr on $ext_if proto tcp from any to any port 29901 -> 10.10.0.5
rdr on $ext_if proto tcp from any to any port 29920 -> 10.10.0.5
## XBConnecT ##
rdr on $ext_if proto tcp from any to any port 8602 -> 10.10.0.4
rdr on $ext_if proto udp from any to any port 8602 -> 10.10.0.4
#############
# Filtering #
#############
# loopback
antispoof log quick for lo0 inet
pass quick on lo0 all
table <ip_deny> persist file "/etc/pf.deny"
# immediately block anything that tries to enter from the blocked ip table
block in log quick on $ext_if proto { tcp, udp, ipv6, icmp, esp, ipencap } from <ip_deny> to any
# immediately prevent IPv6 traffic from entering or leaving all interfaces
block in log quick inet6 all
block out log quick inet6 all
# block and log everything by default
#block return log on $ext_if all
# block anything coming from source we have no back routes for
block in quick from no-route to any
# Block and log outgoing packets that don't have our address as source,
# they are either spoofed or something is misconfigured NAT disabled,
# (for instance), we want to be nice and don't send out garbage.
block out log quick on $ext_if from ! $ext_if to any
pass in log all
pass out log on $ext_if inet proto tcp from ($int_if) to any flags S/SA keep state queue(std_out, tcp_ack_out)
pass out log on $ext_if inet proto { udp icmp } from ($int_if) to any keep state
pass out log on $ext_if inet proto tcp from ($int_if) to any port $ssh_ports flags S/SA keep state queue(std_out, ssh_im_out)
pass out log on $ext_if inet proto tcp from ($int_if) to any port $im_ports flags S/SA keep state queue(ssh_im_out, tcp_ack_out)