#BLOCK ABUSIVE AND OTHER STUPID HOSTS AUTOMAGICALLY
block in quick from <abusive_hosts>
#BLOCK RFC1918 ADDRESSES COMING IN AND BLOCK IP/CIDR BY ADDING TO /ETC/SPAMMERS
block in quick on $ext_if from { <rfc1918>, <spammers> } to any
#PASS IN ROUTER/MODEM
#pass in quick on $ext_if from 192.168.1.1 to any
#pass in quick on $ext_if proto tcp from 192.168.1.1 to $int_if
#pass in quick on rl0 proto tcp from 192.168.1.1 to $int_if
#pass in quick on rl0 proto tcp from 192.168.1.1 to 192.168.0.3
#SPEED UP FTP SERVER INCOMING TRAFFIC
pass in quick on $ext_if proto tcp from any to $host1 port 21 keep state
#pass in quick on $ext_if proto tcp from any to $host1 \
port > 2047 keep state
#pass in quick on $ext_if proto tcp from any to $host1 port > 49999 keep state
pass in quick on $ext_if proto tcp from any to $host1 port > 2047 keep state
#PASS SINGLE PORT FOR AZUREUS
pass in quick on $ext_if proto { tcp, udp } from any to $host1 \
port 18734 keep state
pass in quick on $ext_if proto { tcp, udp } from any to $host1 \
port 55555 keep state
pass in quick on $ext_if proto tcp from any to $host1 port 1025:1050 keep state
#TEST FOR XCHAT
#pass in quick on $ext_if proto { tcp, udp } from any to $host1 \
# port 113 keep state
#SPEED UP FTP SERVER OUTGOING TRAFFIC
#pass out quick on $int_if proto tcp from any to $host1 port 21 keep state
#pass out quick on $int_if proto tcp from any to $host1 port > 49999 keep state
#MODULATE STATE FOR BETTER PACKET FILTERING PERFORMANCE - HTTP://WWW.OPENBSD.ORG/FAQ/PF/FILTER.HTML
pass out on $ext_if proto { tcp, udp, icmp } from any to any modulate state (if-bound)
#pass out quick on $ext_if proto { tcp, udp } from $host3 to any port 1025:1050
#pass in quick on $ext_if proto { tcp, udp } from any to $host3 port 1025:1050
#ALLOW TRAFFIC IN AND OUT OF THE INTERNAL NETWORK TO THE FIREWALL
pass in quick on $int_if
pass in quick on $int_if from $network to 192.168.0.2
pass out quick on $int_if from 192.168.0.3 to $network
#ALLOW ICMP REQUESTS
pass in inet proto icmp all icmp-type echoreq keep state
#ALLOW DHCP for rl1
pass in quick on rl1 proto { tcp, udp } from any port 67
#ALLOW TRAFFIC FROM THE EXTERNAL INTERFACE TO THE APACHE LISTENING ON XL0/192.168.0.2
#pass in on $ext_if proto tcp from any to xl0 port www flags S/SA synproxy state
pass in quick on $ext_if proto tcp from any to ($ext_if) port 80
#TRY THIS TO SEE IF IT WORKS, SEEMS SMARTER TO FIREWALL AND CONTROL HTTP CONNECTIONS BESIDES HTTPD.CONF
#pass in on $ext_if proto tcp from any to xl0 \
# port www flags S/SA synproxy state \
# (max 200, source-track rule, max-src-nodes 100, max-src-states 3 max-src-conn 100, max-src-conn-rate 15/5, overload <ab
#ALLOW SSH AND LOG CONNECTIONS RUNNING ON THE FIREWALL
#pass in quick log on $ext_if proto tcp from any to $ext_if port ssh flags S/SA synproxy state
#pass in quick log on $ext_if proto tcp from any to any port 22 keep state
pass in quick on $ext_if inet proto tcp from any to ($ext_if) port 22 modulate state (source-track rule max-src-nodes 8 max--src-conn 8 max-src-conn-rate 3/60 overload <scanners> flush global)
#ALLOW FTP TRAFFIC IN ON VSFTPD RUNNING ON FIREWALL
pass in on $ext_if proto tcp from any to any port 21 keep state
#pass in on $ext_if proto tcp from any to any port > 49151 \
# keep state
#block in on $both_ext_if proto { tcp, udp } from any to any port 53
#block in on $both_ext_if proto { tcp, udp } from any to any port 135
#block in on $both_ext_if proto { tcp, udp } from any to any port 137
#block in on $both_ext_if proto { tcp, udp } from any to any port 138
#block in on $both_ext_if proto { tcp, udp } from any to any port 139
#block in on $both_ext_if proto { tcp, udp } from any to any port 427
#block in on $both_ext_if proto { tcp, udp } from any to any port 445
#block in on $both_ext_if proto { tcp, udp } from any to any port 548
#block in on $both_ext_if proto { tcp, udp } from any to any port 593
#block in on $both_ext_if proto { tcp, udp } from any to any port 4444