ext_if="tun0"
int_if="dc0"
#localnet="sis0"
loop="lo0"
int_net="192.168.0.0/24"
#table <spamd-white> persist
#table <bruteforce> persist file "/etc/pf.table.bruteforce"
set optimization normal
set block-policy return
set skip on $loop
scrub in on $ext_if all
#scrub in on $localnet all
scrub in all
#scrub out on pppoe max-mss 1440
nat on $ext_if from $int_net to any -> ($ext_if)
#Bloquear todo R
block in all
##Interfaces conectada a la red interna
#Aceptamos todo el trafico de entrada/salida
pass in quick on $int_if all
pass out quick on $int_if all
#Interface conectada al enlace con internet,solo aceptamos
#trafico icmp de entrada y tcp/udp de respuesta alos paquetes
#ssh R
pass in on $ext_if proto tcp from any to any port {ssh} keep state
#pass in quick on $ext_if proto icmp all keep state
#pass out quick on $ext_if from $int_net to any keep state
#R
pass in on $ext_if proto udp from any to any port { domain, ntp } keep state
#nat-anchor "ftp-proxy/*"
#rdr-anchor "ftp-proxy/*"
#nat on $ext_if from !($ext_if) -> ($ext_if:0)
#rdr pass on $int_if proto tcp to port ftp -> 127.0.0.1 port 8021
#no rdr on $ext_if proto tcp from <spamd-white> to any port smtp
#rdr pass on $ext_if proto tcp from any to any port smtp \
# -> 127.0.0.1 port spamd
#block quick from <bruteforce>
#anchor "ftp-proxy/*"
#block in log all
#pass out log all
#pass quick on $int_if no state
#antispoof quick for { lo $int_if }
#pass inet proto tcp from any to $localnet port ssh \
flags S/SA keep state \
(max-src-conn 100, max-src-conn-rate 10/5, \
overload <bruteforce> flush global)
#pass in on $ext_if proto tcp to ($ext_if) port ssh
#pass in log on $ext_if proto tcp to ($ext_if) port smtp
#Roa
pass in quick on $ext_if proto icmp all keep state
pass out quick on $ext_if from $int_net to any keep state
pass out quick on $ext_if proto {tcp,udp,icmp} to any keep state