# OBJECTIVES
#
# - Have an Ethernet LAN on 10.0.0.0/24
# - Have an 802.11bg LAN on 10.0.1.0/24
# - Unrestricted internet for 10.0.0.0/23
# - Provide all of the following services:
# + Response to ping
# + 22 -> 10.0.0.1:22 (SSH)
# + 8080 -> 10.0.0.1:80 (WWW)
# USER-SERVICABLE PARTS
# Options in the following section are subject to change
# with reality. If something external to pf changes, you
# should only have to touch this section.
############################################################
# Controls logging.
logopt = "log"
# Interface/network specification
ext_if = "xl0" # external
elan_if = "rl0" # ethernet
wlan_if = "ath0" # wifi
lan_ifs = "{ rl0 ath0 }" # all internal interfaces
lan_net = "{ 10.0.0.0/23 }" # whole network (e+w)
# SSH
ssh_ext_port = "1022"
ssh_srv = "10.0.0.1 port 22"
# HTTP
http_ext_port = "8888"
http_srv = "10.0.0.1 port 80"
############################################################
# Everything below this point is routing commands, e.g.
# nothing that is configured by the variables above.
############################################################
# GENERAL CONFIGURATION
# Options that are not associated with overall network
# traffic flow.
############################################################
# Keep loopback interfaces on the local machine free of pf
# overhead.
set skip on lo
# Keep logs of traffic on the external interface.
set loginterface $ext_if
# Don't drop as many connections.
set optimization conservative
# NAT
nat on $ext_if from $lan_net to any -> ($ext_if)
rdr on $ext_if proto tcp to port $ssh_ext_port -> $ssh_srv
rdr on $ext_if proto tcp to port $http_ext_port -> $http_srv
# INTERNAL AND OUTBOUND TRAFFIC
# LAN-to-LAN and LAN-to-world traffic.
############################################################
# Allows all traffic on the LAN interfaces, so traffic is
# only stopped at $ext_if.
pass quick on $lan_ifs
# Allow all traffic to reach the outside world.
pass out quick on $ext_if keep state
# OUTSIDE WORLD TRAFFIC
# Traffic coming in from the outside world.
############################################################
# Default block policy
block in on $ext_if
# Allow ICMP (pinging)
pass in on $ext_if proto icmp keep state
pass in on $ext_if inet proto tcp to $ssh_srv flags S/SA synproxy state
pass in on $ext_if inet proto tcp to $http_srv flags S/SA synproxy state