cmd="ipfw -q add"
skip="skip to 500"
pif="rl0"
ks="keep-state"
good_tcpo="22,25,37,43,53,80,443,110,119,5050,5051,5100"
bad_tcpo="135,137,138,139,445"
ipfw -q -f flush
$cmd 002 allow all from any to any via xl0
$cmd 003 allow all from any to any via lo0
$cmd 100 divert natd ip from any to any in via $pif
$cmd 101 check-state
### Outbond Public Interface
$cmd 120 $skip udp from any to 202.122.9.242 53 out via $pif $ks
$cmd 121 $skip tcp from any to 202.122.9.242 53 out via $pif $ks
$cmd 122 $skip tcp from any to $good_tcpo out via $pif setup $ks
$cmd 130 $skip icmp from any to any out via $pif $ks
$cmd 135 $skip udp from any to any out via $pif
### Inbound Public Interface
$cmd 300 deny all from 192.168.0.0/16 to any in via $pif
$cmd 301 deny all from 172.16.0.0/12 to any in via $pif
$cmd 302 deny all from 10.0.0.0/8 to any in via $pif
$cmd 303 deny all from 127.0.0.0/8 to any in via $pif
$cmd 304 deny all from 0.0.0.0/8 to any in via $pif
$cmd 305 deny all from 169.254.0.0/16 to any in via $pif
$cmd 306 deny all from 192.0.2.0/24 to any in via $pif
$cmd 307 deny all from 204.152.64.0/23 to any in via $pif
$cmd 308 deny all from 224.0.0.0/3 to any in via $pif
$cmd 320 deny tcp from any to any $bad_tcpo in via $pif
$cmd 321 deny udp from any to any $bad_tcpo in via $pif
$cmd 330 deny all from any to any frag in via $pif
# natd
$cmd 500 divert natd ip from any to any out via $pif
$cmd 510 allow ip from any to any
$cmd 600 allow tcp from 192.168.13.222 to any 80
$cmd 601 fwd 192.168.1.254,9000 tcp from any to any 80 recv rl1
$cmd 700 deny log ip from any to any