WAN="hme1"
LAN="hme2"
WLAN="hme3"
DMZ1="hme4"
DMZ2="hme5"
DMZ3="hme6"
IPV6="gif0"
table <firewall> const {self}
table <IPSpoof-LAN> file "/etc/pf/spoofing/IPSpoof-LAN"
table <IPSpoof-WLAN> file "/etc/pf/spoofing/IPSpoof-WLAN"
table <IPSpoof-DMZ1> file "/etc/pf/spoofing/IPSpoof-DMZ1"
table <IPSpoof-DMZ2> file "/etc/pf/spoofing/IPSpoof-DMZ2"
table <IPSpoof-DMZ3> file "/etc/pf/spoofing/IPSpoof-DMZ3"
table <LocalNetworks> file "/etc/pf/spoofing/IPSpoof-Networks"
table <DNS-Servers> file "/etc/pf/services/DNS-Servers"
table <defaultdrop> file "/etc/pf/default/defaultdrop"
table <dropicmp> file "/etc/pf/default/dropicmp"
INTERNET="{! <LocalNetworks> }"
set skip on lo
set loginterface hme0
set block-policy drop
scrub in
# ------------------------- NAT -------------------------------
nat on $WAN from <IPSpoof-LAN> to $INTERNET -> ($WAN) # vr: LAN HIDE-NAT
nat on $WAN from <IPSpoof-WLAN> to $INTERNET -> ($WAN) # vr: WLAN HIDE-NAT
# ------------------------- RDR -------------------------------
nat-anchor "ftp-proxy/*"
rdr-anchor "ftp-proxy/*"
rdr pass on $LAN proto tcp from <IPSpoof-LAN> to any port 21 -> 127.0.0.1 port 8021
rdr pass on $WLAN proto tcp from <IPSpoof-WLAN> to any port 21 -> 127.0.0.1 port 8021
# rdr pass on $WAN proto tcp from any to any port 80 -> 192.168.3.2 port 80
# ----------------------- DEFAULT -----------------------------
# DEFAULT DROP
block log
block log quick from <defaultdrop> # vr: Block Specific Users
block log quick proto icmp from <dropicmp> # vr: Disable ICMP for Specific Users
# SPOOFING
block in log quick on $WAN from <IPSpoof-LAN> to any
block in log quick on $WAN from <IPSpoof-WLAN> to any
block in log quick on $WAN from <IPSpoof-DMZ1> to any
block in log quick on $WAN from <IPSpoof-DMZ2> to any
block in log quick on $WAN from <IPSpoof-DMZ3> to any
block in log quick on ! $LAN from <IPSpoof-LAN> to any
block in log quick from ($LAN) to any
block in log quick on ! $WLAN from <IPSpoof-WLAN> to any
block in log quick from ($WLAN) to any
block in log quick on ! $DMZ1 from <IPSpoof-DMZ1> to any
block in log quick from ($DMZ1) to any
block in log quick on ! $DMZ2 from <IPSpoof-DMZ2> to any
block in log quick from ($DMZ2) to any
block in log quick on ! $DMZ3 from <IPSpoof-DMZ3> to any
block in log quick from ($DMZ3) to any
# ------------------------ INHERIT ----------------------------
pass log quick from <firewall> to any keep state # vr: Allows the Firewall to talk to *
pass log quick inet proto icmp from $INTERNET to ($WAN) icmp-type echoreq keep state # vr: WAN Interface Pingable
# ------------------------- POLICY ----------------------------
pass log quick inet proto tcp from any to 192.168.3.2 port 80 keep state
# LAN <> ANY
pass log quick inet proto icmp from <IPSpoof-LAN> to any icmp-type echoreq keep state # vr: ICMP/echo
pass log quick inet proto udp from <IPSpoof-LAN> to any port 33000><33999 keep state # vr: TRACEROUTE
# LAN <> WLAN
pass log quick from <IPSpoof-LAN> to <IPSpoof-WLAN> keep state # vr: Access WLAN
pass log quick inet proto tcp from <IPSpoof-WLAN> to <firewall> port 22 keep state
pass log quick inet proto tcp from <IPSpoof-WLAN> to 192.168.1.101 port 80 keep state # vr: Access to mythtv
# LAN <> WAN
pass log quick proto udp from <IPSpoof-LAN> to <DNS-Servers> port 53 keep state # vr: DNS
pass log quick from <IPSpoof-LAN> to $INTERNET keep state # vr: Internet Access for LAN
# LAN <> DMZ1
pass log quick from <IPSpoof-LAN> to <IPSpoof-DMZ1> keep state # vr: Access to DMZ1
pass log quick from <IPSpoof-DMZ1> to $INTERNET keep state # vr: DMZ DNS
# WLAN <> WAN
pass log quick proto udp from <IPSpoof-WLAN> to <DNS-Servers> port 53 keep state # vr: DNS
pass log quick from <IPSpoof-WLAN> to $INTERNET keep state # vr: Internet Access for WLAN
# FIREWALL
pass log quick proto tcp from <IPSpoof-LAN> to ($LAN) port 22 keep state # vr: SSH ACCESS FROM LAN
pass log quick proto tcp from <IPSpoof-LAN> to ($LAN) port 8021 keep state # vr: SSH ACCESS FROM LAN
pass log quick proto tcp from $INTERNET to ($WAN) port 22 keep state # vr: SSH ACCESS FROM INTERNET
anchor "ftp-proxy/*"
pass out proto tcp from <firewall> to any port 21 keep state
block log quick to <firewall> # vr: FIREWALL CATCHALL