### Interfaces
ext_if="xl0" # External Interface
int_if="em0" # Internal Interface
wifi_if="em1" # Wireless Interface
### Servers
obsd="10.10.0.7"
pwed="10.10.0.6"
fs="10.10.0.5"
drue="20.10.0.11"
### Tables
# Non-public/weird addresses, doesn't include our 10.10.x.x subnet, anything in here shouldn't be going anywhere
table <banned> { 192.168.0.0/16, 192.0.2.0/24, 172.16.0.0/12, 127.0.0.0/8, 169.254.0.0/16 }
### Options
set timeout { frag 15, interval 5 }
set optimization aggressive
set block-policy drop
set loginterface $ext_if
#set loginterface $int_if
#set loginterface $wifi_if
set state-policy if-bound
### Normalization: reassemble fragments
scrub on $ext_if all
scrub on $int_if all
scrub on $wifi_if all
### Translation: specify how addresses are to be mapped or redirected.
nat on $ext_if from any to any -> ($ext_if)
#nat on $ext_if from $int_if:network to ! $int_if -> ($ext_if)
#nat on $ext_if from $wifi_if:network to ! $wifi_if -> ($ext_if)
rdr on $ext_if proto tcp from 72.36.210.10/29 to any port 21 -> $obsd
rdr on $ext_if proto tcp from any to any port 22 -> $pwed
rdr on $ext_if proto tcp from any to any port 443 -> $pwed port 22
rdr on $ext_if proto tcp from any to any port 900:950 -> $fs
rdr on $ext_if proto tcp from any to any port 44344 -> $fs port 444
#rdr on $ext_if proto tcp from any to any port 5900 -> 10.10.0.100
rdr on $ext_if proto tcp from 125.186.78.28 to any port 3306 -> $fs
#rdr on $ext_if proto tcp from 72.36.210.10/29 to any port 49152:65535 -> $obsd port 49152:65535
# Squid proxy on Wireless network
#rdr on $wifi_if inet proto tcp from any to any port www -> 127.0.0.1 port 3128
#rdr on $int_if inet proto tcp from any to any port www -> 127.0.0.1 port 3128
### Filtering
pass quick on lo0
block quick on lo0
# Block banned
block log quick from <banned> to any
block quick from any to <banned>
# all traffic to/from the wireless network to the internal network
#block in log quick on $wifi_if from 20.10.0.0/16 to 10.10.0.0/16
#block out log quick on $wifi_if from 10.10.0.0/16 to 20.10.0.0/16
block in quick on $wifi_if inet proto { udp, tcp } from any to any port { 67, 68 }
block in quick on $ext_if inet proto udp from any to any port { 1020:1090, 10420:10430 }
block in quick on $ext_if inet proto { tcp, udp } from any to any port { 161 }
block in quick on $ext_if inet6 proto tcp from any to any port 113
block in quick on $ext_if inet6 proto ipv6-icmp from any to any
#block out quick on $ext_if inet6 proto icmp6 from any to any
### Services
pass in log quick on $ext_if proto tcp from any to any port { 22, 443 } flags S/SA \
synproxy state (max 30, source-track rule, max-src-nodes 10, max-src-states 2, \
max-src-conn 2, max-src-conn-rate 2/60, overload <banned>)
#pass in quick on $ext_if proto tcp from any to any port { 7000, 3306 } keep state (max 10, source-track rule, max-src-nodes 5, max-src-states 2, max-src-conn 2, max-src-co
nn-rate 2/60, overload <banned>)
pass in quick on $ext_if proto tcp from any to any port { 113, 444, 5900, 44344 } keep state
#pass in log quick on $ext_if proto { tcp, udp } from any to any port { 2300:2400, 47624 } keep state
#pass in quick on $ext_if proto tcp from 72.36.210.10/29 port { 21, 49152:65535 } keep state
pass in quick on $ext_if proto tcp from any to any port 900:950 keep state
# Squid pass rules
#pass in log quick on $wifi_if inet proto tcp from any to any port 3128 keep state
#pass out log quick on $wifi_if inet proto tcp from any to any port 3128 keep state
#pass in log quick on $int_if inet proto tcp from any to any port 3128 keep state
#pass out log quick on $int_if inet proto tcp from any to any port 3128 keep state
pass in quick on $wifi_if from $wifi_if:network to any keep state
pass in quick on $int_if from $int_if:network to any keep state
pass in quick on $int_if inet6 proto ipv6-icmp from any to any
pass in quick on $int_if inet6 proto ipv6 from any to any
pass in quick on $int_if inet proto ipv6 from any to any
pass in quick on $int_if inet6 proto tcp from any to any
pass out quick on $ext_if inet6 proto ipv6-icmp from any to any
pass out quick on $ext_if inet6 proto ipv6 from any to any
pass out quick on $ext_if inet proto ipv6 from any to any
pass out quick on $ext_if inet6 proto tcp from any to any
pass in quick on $ext_if inet6 proto ipv6-icmp from any to any
pass in quick on $ext_if inet6 proto ipv6 from any to any
pass in quick on $ext_if inet proto ipv6 from any to any
pass in quick on $ext_if inet6 proto tcp from any to any
pass out quick on $int_if inet6 proto icmp6 from any to any
pass out quick on $int_if proto ipv6 from any to any
pass out quick on $wifi_if from any to $wifi_if:network keep state
pass out quick on $int_if from any to $int_if:network keep state
#block in quick on gif0 inet6 proto ipv6-icmp from any to any
#block in quick on gif0 inet6 proto tcp from any to 2001:240:582:101::1337 port { 21, 22, 113, 444, 199, 37, 13 }
pass in quick on gif0 from any to any
pass out quick on gif0 from any to any
pass in quick on gif0 inet6 all keep state
pass out quick on gif0 inet6 all keep state
block in log quick from any to { $int_if, ($ext_if), $wifi_if }
pass in quick on $int_if proto { tcp, udp, ipv6 } from $int_if to $int_if:network keep state
pass in quick on $int_if proto { ipv6 } from any to any keep state
pass in quick on $int_if inet6 proto icmp6 from any to any
pass out quick on $int_if inet6 proto icmp6 from any to any
pass in quick on $int_if inet6 proto ipv6 from any to any
pass out quick on $int_if proto { ipv6 } from any to any keep state
pass in quick on $wifi_if proto { tcp, udp, icmp } from $wifi_if to $wifi_if:network keep state
pass out quick on $wifi_if proto { ipv6, tcp, udp, icmp } from any to any keep state
pass out quick on $int_if proto { ipv6, tcp, udp, icmp } from any to any keep state
#pass out quick on $ext_if proto { tcp, udp, icmp } from ($ext_if) to any keep state
pass out quick on $ext_if proto {ipv6, tcp, udp, icmp, gre } from ($ext_if) to any keep state
pass in quick on $ext_if proto { ipv6, tcp, udp, icmp } from ($ext_if) to any keep state
# We can check what gets caught here to see if we've missed anything
block log all