##########
# Macros #
##########
ext_if="ex0"
int_if="tlp0"
dmz_if="tlp1"
ext=$int_if:network
int=$int_if:network
dmz=$dmz_if:network
##########################
# Non-routable addresses #
##########################
nonroutable = "{ 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, \
10.0.0.0/8, 169.254.0.0/16, 192.0.2.0/24, \
0.0.0.0/8, 240.0.0.0/4 }"
###########
# Options #
###########
set block-policy drop
set loginterface $ext_if
############
# Services #
############
tcp_services = "{ ssh, domain, http, https, auth, smtp, smtps, imap, imaps, irc }"
udp_services = "{ domain, irc }"
icmp_services = "{ echoreq }"
#########
# Scrub #
#########
scrub no-df random-id fragment reassemble
#############
# antispoof #
#############
antispoof for $ext_if
antispoof for $int_if
antispoof for $dmz_if
###########
# NAT/RDR #
###########
nat on $ext_if from !($ext_if) to any -> ($ext_if)
nat on $int_if from !($int_if) to any -> ($int_if)
nat on $dmz_if from !($dmz_if) to any -> ($dmz_if)
################
# Filter Rules #
################
block in quick on $ext_if
# SSH
pass in quick on $ext_if proto tcp from any to any port 22 flags S/SA keep state
# Non routable
block drop in quick on $ext_if from $nonroutable to any
block drop out quick on $ext_if from any to $nonroutable
# Greenlighted ports
pass in on $ext_if inet proto tcp from any to ($ext_if) \
port $tcp_services flags S/SA keep state
pass in on $ext_if inet proto udp from any to ($ext_if) \
port $udp_services keep state