# Macros: define common values, so they can be referenced and changed easily.
ext_if="em0"
#ext_if="ext0" # replace with actual external interface name i.e., dc0
int_if="rl0" # replace with actual internal interface name i.e., dc1
#mail_ports="{ 25, 143, 993 }"
# ftp_ports="{ 20, 21 }"
icmp_types="echoreq"
## SET ###
set block-policy return
set loginterface $ext_if
set skip on lo
# Tables: similar to macros, but more flexible for many addresses.
table <webservers> {207.38.100.130}
# table <mailserver> {207.38.100.130}
table <dnsservers> {67.15.31.131}
table <sshserver> {207.38.100.130}
table <ftpserver> {207.38.100.130}
table <fuder> {207.38.100.130}
## SCRUB ##
# Normalization: reassemble fragments and resolve or reduce traffic ambiguities.
scrub in all
## NAT/TRANSLATION ##
#nat-anchor "pftpx/*"
#rdr-anchor "pftpx/*"
#rdr pass on $ext_if proto tcp from any to any port 21 -> 127.0.0.1 port 8021
## FILTERING RULES##
# block all incoming packets by default
block in log all
# allow SSH into machine
#pass in on $ext_if proto tcp from any to <sshserver> port 22 keep state
pass in on $ext_if proto tcp from 65.248.20.11 to <sshserver> port 22 keep state
pass in on $ext_if proto tcp from 65.248.20.2 to <sshserver> port 22 keep state
# allow fuder
pass in on $ext_if proto tcp from any to <fuder> port 8348 keep state
# allow ftp
pass in on $ext_if proto tcp from 65.248.20.11 to <ftpserver> port 21 keep state
pass in on $ext_if proto tcp from 65.248.20.2 to <ftpserver> port 21 keep state
# allow all outbound connections
pass out on $ext_if proto { tcp, udp } all keep state
#pass incoming HTTP traffic to main webserver
pass in on $ext_if proto tcp from any to <webservers> port 80 flags S/SAFPRU keep state
# pass ident traffic
pass in on $ext_if proto {tcp, udp} from any to any port 113 keep state
#pass incoming email traffic
#pass in on $ext_if proto tcp from any to <mailserver> port $mail_ports flags S/SAFPRU keep state
#flags S/SA
#pass incoming DNS traffic
pass in on $ext_if proto {tcp, udp} from any to <dnsservers> port 53 keep state
# allow pings
#pass in inet proto icmp all icmp-type $icmp_types keep state
pass in quick inet proto icmp from any to any keep state
pass out inet proto icmp from any to any keep state
# FTP proxy
#anchor "pftpx/*"