## Firewall & NAT rules ##
# rl0 is connected to the internet (84.215.128.1/18)
# vr0 is connected to the lan (192.168.1.0/24)
## End info
## Macros
ekstern="rl0"
intern="vr0"
## End macros
## Global options
set skip on lo # Dont need to monitor lo interface
set block-policy drop # Dropper blokkete pakker fremfor a sende TCP-RST
set loginterface rl0 # Her kan det samles statestikk med pfstat, kun et if om gangen
scrub in all # The scrub directive also reassembles fragmented packets,
#protecting some operating systems from some forms of attack, and drops TCP packets that have invalid flag combinations.
## End global
## Start NAT
nat on $ekstern from $intern:network to any -> ($ekstern)
## End Nat
#block in all
pass out keep state
# ALTQ
altq on $ekstern priq bandwith 1075Kb queue { que_pri, que_def }
queue que_pri priority 7
queue que_def priority 1 (default)
pass in on $ekstern from any to ($ekstern) flags S/SA keep state queue { que_def, que_pri }
pass out on $ekstern from $intern:network to !($ekstern) flags S/SA keep state queue { que_def, que_pri }
# /ALTQ
#pass in inet proto tcp from any to any port ssh keep state flags S/SA
## Services allowed TO $ekstern
## end TO $ekstern
## Services allowed TO $intern
## end TO $intern