ext_if = "dc0"
int_if = "dc1"
host1 = 192.168.1.2
services_firewall = { http, ftp }
services_host1 = { 18734, 55555, 1025:1050 }
table <abusive_hosts> persist
table <spammers> persist
# scrub incoming packets
scrub in
# ignore loopback interface
set skip on lo0
# translation
nat on $ext_if from $int_if:network to any -> $ext_if
rdr on $ext_if from any to $ext_if port $services_host1 -> $host1
# block abusive users
block in quick on $ext_if from { <abusive_hosts>, <spammers> }
# base block
block in on $ext_if
# allow outgoing connections
pass out quick on $ext_if proto tcp modulate state
pass out quick on $ext_if keep state
# allow icmp echo requests
pass in quick on $ext_if proto icmp from any to $ext_if icmp-type echo-request keep state
# we allow ssh seperately, so we can block abusive hosts
pass in quick on $ext_if proto tcp from any to $ext_if port ssh modulate state (source-track rule max-src-nodes 8 max--src-conn 8 max-src-conn-rate 3/60 overload <abusive_hosts> flush global)
# allow services to firewall
pass in quick on $ext_if proto tcp from any to $ext_if port $services_firewall modulate state
# allow services to host1
pass in quick on $ext_if proto tcp from any to $host1 port $services_host1 modulate state