##########
# Macros #
##########
ext_if="ex0"
int_if="tlp0"
dmz_if="tlp1"
##########################
# Non-routable addresses #
##########################
nonroutable = "{ 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, \
10.0.0.0/8, 169.254.0.0/16, 192.0.2.0/24, \
0.0.0.0/8, 240.0.0.0/4 }"
###########
# Options #
###########
set skip on { lo0, tlp0 }
############
# Services #
############
# Application Ports (not listed in services)
#
# AIM = 5190
# GTalk = 5222
# ICQ =
# MSN =
# YIM =
# Live! =
tcp_services = "{ ssh, domain, http, https, auth, smtp, smtps, imap, imaps, irc, bootps, bootpc, cvspserver, 5190, 6901, 6891, 6667, 88, 3074, 5222 }"
udp_services = "{ domain, irc, bootps, bootpc, 88, 3074 }"
icmp_services = "{ 0, 30 }"
#########
# Scrub #
#########
scrub in all no-df
###########
# NAT/RDR #
###########
nat on $ext_if from !($ext_if) -> ($ext_if:0)
rdr-anchor miniupnpd
anchor miniupnpd
#############
# antispoof #
#############
antispoof for $ext_if
antispoof for $int_if
antispoof for $dmz_if
################
# Filter Rules #
################
block in log all
block out log all
# Non routable
#block drop in quick on $ext_if from $nonroutable to any
#block drop out quick on $ext_if from any to $nonroutable
# Greenlighted ports
pass in on $ext_if inet proto tcp from any to ($ext_if) port $tcp_services flags S/SA keep state
pass in on $ext_if inet proto udp from any to ($ext_if) port $udp_services keep state
pass out on $ext_if inet proto tcp from ($ext_if) to any port $tcp_services flags S/SA keep state
pass out on $ext_if inet proto udp from ($ext_if) to any port $udp_services keep state
pass in on $int_if inet proto tcp from any to ($int_if) port $tcp_services flags S/SA keep state
pass in on $int_if inet proto udp from any to ($int_if) port $udp_services keep state
pass out on $int_if inet proto tcp from ($int_if) to any port $tcp_services flags S/SA keep state
pass out on $int_if inet proto udp from ($int_if) to any port $udp_services keep state
# ICMP (Ping only for now)
pass out on $ext_if inet proto icmp all icmp-type 8 code 0 keep state
pass out on $int_if inet proto icmp all icmp-type 8 code 0 keep state
pass in on $int_if inet proto icmp all icmp-type 8 code 0 keep state