### CONSTANTS ###
#ethernet interfaces
internal = "fxp0"
external = "xl0"
#services running on the server
services = "{ ssh, http, ftp }"
icmp_types = "echoreq"
#list of non routable IPs
nonroutable = "{ 192.168.0.0/16, 127.0.0.0/8, 172.16.0.0/12, \
10.0.0.0/8, 0.0.0.0/8, 169.254.0.0/16, \
192.0.2.0/24, 204.152.64.0/23, 224.0.0.0/3, \
255.255.255.255/32 }"
#################
### OPTIONS ###
set block-policy return
set loginterface $external
set skip on lo0
##############
### SCRUB ###
scrub in all
############
### NAT ###
nat on $external from 192.168.1.0/24 to any -> $external
###########
### REDIRECTS TO LOCAL MACHINE ###
#redirect access to apocalipse apache
rdr pass on $external proto tcp from any to any port 8064 -> 192.168.1.64 port 80
rdr pass on $external proto tcp from any to any port 2264 -> 192.168.1.64 port 22
rdr pass on $external proto tcp from any to any port 6881 -> 192.168.1.64 port 6881
rdr pass on $external proto udp from any to any port 4444 -> 192.168.1.64 port 4444
rdr pass on $internal proto tcp from any to any port 21 -> 127.0.0.1 \
port 8021
###################################
### FILTER RULES ###
block all
block drop in quick on $external from $nonroutable
block drop out quick on $external from any to $nonroutable
pass in on $external inet proto tcp from any to $external \
port $services flags S/SA keep state
pass in on $external inet proto tcp from port 20 to $external \
user proxy flags S/SA keep state
#allow FTP connections
pass in on $external proto tcp from any to any port > 49151 \
keep state
pass in inet proto icmp all icmp-type $icmp_types keep state
pass in quick on $internal from $internal:network to any keep state
pass out quick on $internal from any to $internal:network keep state
pass out on $external proto tcp all modulate state flags S/SA
pass out on $external proto { udp, icmp } all keep state
### EOF ###