### MACRO DEFS ###
EXT="xl0"
INT="dc0"
NAT_P="{ tcp, udp }"
#BADIPS="{ 172.16.0.0/12, 127.0.0.1/8, 0.0.0.0/8, 169.254.0.0/16, 224.0.0.0/3 }"
BADIPSX="{ 172.16.0.0/12, 127.0.0.1/8, 0.0.0.0/8, 169.254.0.0/16, 224.0.0.0/3, 10.0.0.0/8 }"
TCP_SERVICES="{ http, ftp, ssh }"
WEBSERVER="10.0.0.2"
### OPTIONS (SET) ###
set block-policy return
set loginterface $EXT
### SCRUB RULES ###
scrub in on $EXT all
#added oct 25 2005
#antispoof for $EXT
#antispoof for $INT
### NAT RULES ###
nat on $EXT from $INT:network to any -> ($EXT)
#rdr on $EXT inet proto tcp from any to any port 80 -> $WEBSERVER port 80
#added oct 25 2005
rdr on $EXT proto tcp from any to any port $TCP_SERVICES -> $WEBSERVER
#added oct 25 2005
antispoof for $EXT
antispoof for $INT
### FILTERING RULES ###
block log all
#permitting traffic on loop back
pass quick on lo0 all
#blocking badips from entering/exiting
block drop in log quick on $EXT from $BADIPSX to any
block drop out log quick on $EXT from any to $BADIPSX
#opening the required ports
pass in log quick on $EXT inet proto tcp from any to ($EXT) port $TCP_SERVICES flags S/SA keep state
#passing web server traffic through to OKIDATA by using synproxy im avoiding outsiders to handshake with OKIDATA
pass in log on $EXT inet proto tcp from any to $WEBSERVER port 80 flags S/SA synproxy state
#Allowing external FTP access?
pass out on $EXT inet proto tcp from $EXT to any port 21 flags S/AUPRFS modulate state