# $Id: pf.conf,v 1.4 2007/06/12 05:49:47 scs Exp scs $
# Firewall ruleset for thewall.b1tt3r.org
# Macros
# Interface Macros
# ext_if == WAN
# int_if1 == b1tt3r
# int_if2 == steinbsd
# int_network == internal network (No shit eh?)
# loop == loopback (NO SHIT EH??!?!)
ext_if = "tun0"
int_if1 = "rl0"
int_if2 = "rl1"
all_ifs = "{" $ext_if $int_if1 $int_if2 "}"
int_network = "10/8, 172.16/12"
int_ip1 = "10.0.0.1"
int_ip2 = "172.16.0.1"
intcpservices = "{ 22, 53, 80 }"
outtcpservices = "{ 1863,22, 25, 21, 53, 80, 6667, 443 }"
inudpservices = "{ 53 }"
outudpservices = "{ 53 }"
icmp_types="echoreq"
# Tables
# noroute == Non-routable addresses
table <noroute> { 127.0.0.1/8, 192.168/16, 172.16/12, 10/8, 255.255.255.255/32 }
#Options
#set optimization aggressive
set block-policy drop
set loginterface $ext_if
#set skip on lo
#Scrub-a-dub-dub
scrub in
#queueing shit.
altq on $ext_if priq bandwidth 100Kb queue { q_pri, q_def }
queue q_pri priority 7
queue q_def priority 1 priq(default)
# Nat and redirection (In that order! VERY IMPORTANT!)
nat on $ext_if from { $int_if1 $int_if2 } -> $ext_if
nat-anchor "ftp-proxy/*"
rdr-anchor "ftp-proxy/*"
rdr pass on $int_if1 proto tcp from any to any port ftp -> 127.0.0.1 port 8021
rdr pass on $ext_if proto {tcp, udp} from any to any port domain -> 10.0.0.2 port domain
rdr pass on $ext_if proto tcp from any to any port ssh -> 10.0.0.30 port ssh
# filter stuff
block log all
pass out from 206.45.95.183 to any keep state
anchor "ftp-proxy/*"
antispoof quick for { lo $int_if1 }
pass in quick on lo0 all
pass out quick on lo0 all
pass in on $ext_if inet proto tcp from any to $ext_if \
port $intcpservices flags S/SA keep state
pass out on $ext_if inet proto tcp from any to any port $outtcpservices flags S/SA keep state
pass in on $ext_if inet proto udp from any to any \
port $inudpservices keep state
pass out on $ext_if inet proto udp from any to any \
port $outudpservices keep state
pass in on $ext_if inet proto tcp from any to 10.0.0.4 port 80 \
flags S/SA keep state
pass inet proto icmp all icmp-type $icmp_types keep state
pass on $int_if1 all
pass on $int_if2 all
pass quick from $int_if1 to $int_if2
pass quick from $int_if2 to $int_if1
#pass in on $ext_if proto tcp from any to any port 21 keep state
pass on $ext_if proto tcp from any to any port > 49151 \
keep state
pass out quick on $ext_if inet proto tcp from ($ext_if) to any port ftp flags S/SA keep state
pass out quick on $ext_if inet proto tcp from ($ext_if) to any user proxy flags S/SA keep state
pass out on $ext_if proto tcp from $ext_if to any flags S/SA \
keep state queue (q_def, q_pri)
pass in on $ext_if proto tcp from any to $ext_if flags S/SA \
keep state queue (q_def, q_pri)