# ------
# Macros
# ------
ext_if = "fxp0"
int_if = "fxp1"
ext_services = "{ auth, ssh, ntp }"
int_services = "{ ssh, sunrpc, nfsd, 691, 889 }"
icmp_types = "{ echoreq, unreach }"
martians = "{ 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, \
10.0.0.0/8, 169.254.0.0/16, 192.0.2.0/24, \
0.0.0.0/8, 240.0.0.0/4 }"
# ------
# Tables
# ------
table <badguys> persist { 24.64.0.0/13 }
table <brutes> persist
# -------
# Options
# -------
set block-policy return
set loginterface $ext_if
set skip on lo0
# -----
# Scrub
# -----
scrub in on $ext_if #may mess with nfs
# --------
# Queueing
# --------
# -----------
# Translation
# -----------
nat on $ext_if from !($ext_if) -> ($ext_if:0)
nat-anchor "ftp-proxy/*"
rdr-anchor "ftp-proxy/*"
# -----------
# redirection
# -----------
rdr pass on $int_if proto tcp to port ftp -> 127.0.0.1 port 8021
# -------------
# Filters Rules
# -------------
#block in log on $ext_if
block in loganchor "ftp-proxy/*"
antispoof log quick for $ext_if
antispoof log quick for $int_if
pass in on $ext_if inet proto { tcp, udp } from any to ($ext_if) \
port $ext_services \
(max-src-conn 100, max-src-conn-rate 2 / 10, \
overload <brutes> flush)
pass in on $int_if inet proto { tcp, udp } from $int_if:network to $int_if \
port $int_services
pass in inet proto icmp all icmp-type $icmp_types
pass quick on $int_if
#weird-o's at shaw cable keep scanning
block drop log (all) quick on $ext_if from <badguys>
block drop quick from <brutes>
block drop in quick on $ext_if from $martians to any
block drop out quick on $ext_if from any to $martians
pass out inet