### pfctl -s queue -v# macrosext_if="..."wlan_if="..."vpn_if="..."kwanza_ipv4="(" $wlan_if ")"ext_ipv4="(" $ext_if ")"wlan_ipv4="(" $wlan_if ")"wlan_network="..../24"toys_ipv4="...."pushpop_ipv4="...."mi3_ipv4="...."icmp_state="keep state"syn_state="flags S/SA synproxy state"tcp_state="flags S/SA modulate state"udp_state="keep state"my_ftp_proxy="...."my_ssh="..."bittorrent_tcp="...:..."bittorrent_udp="..."dcc="...:..."gnutella="..."openft_main="...."openft_http="...."### Stateful Tracking Options ###ext_if_STO ="(max 9000, source-track rule, max-src-conn 2000, max-src-nodes 254)"wlan_if_STO ="(max 250, source-track rule, max-src-conn 100, max-src-nodes 254, max-src-conn-rate 75/20)"spamd_STO ="(max 500, source-track rule, max-src-conn 10, max-src-nodes 300, max-src-conn-rate 2/300, tcp.established 10)"ssh_STO ="(max 10, source-track rule, max-src-states 10, max-src-nodes 5, max-src-conn-rate 20/60, overload <OVERLOAD_SSH> flush global)"#tablestable <authpf_users> persisttable <BLACKLIST> persist file "/etc/blacklist"table <SLOWQUEUE> persist file "/etc/slowqueue"table <OVERLOAD_SSH> persist file "/etc/overloaded_ssh"### Optionsset debug urgentset require-order yesset block-policy dropset loginterface $ext_ifset state-policy if-boundset fingerprints "/etc/pf.os"set ruleset-optimization none# Timeout Optionsset optimization aggressiveset timeout { frag 10, tcp.established 3600 }set timeout { tcp.first 30, tcp.closing 30, tcp.closed 30, tcp.finwait 30 }set timeout { udp.first 30, udp.single 30, udp.multiple 30 }set timeout { other.first 30, other.single 30, other.multiple 30 }set timeout { adaptive.start 5000, adaptive.end 10000 }set skip on lo# scrubscrub log on $ext_if all random-id min-ttl 254 max-mss 1454 reassemble tcp fragment reassemble#scrub in### Queueingaltq on $ext_if priq bandwidth 200Kb queue { q_pri, q_def }queue q_pri priority 7queue q_def priority 1 priq(default)# nat/rdrnat on $ext_if from !($ext_if) -> ($ext_if:0)nat-anchor "ftp-proxy/*"rdr-anchor "ftp-proxy/*"nat-anchor "authpf/*"binat-anchor "authpf/*"rdr-anchor "authpf/*"### Routingrdr on { $wlan_if, $vpn_if } \ proto tcp \ to port ftp \ -> 127.0.0.1 port $my_ftp_proxyrdr on $wlan_if \ inet proto tcp \ from ! <authpf_users> \ to any port http \ -> $kwanza_ipv4 port http# p2prdr on $ext_if \ inet proto tcp \ from any \ to $ext_ipv4 port $bittorrent_tcp \ -> $toys_ipv4 port $bittorrent_tcprdr on $ext_if \ inet proto udp \ from any \ to $ext_ipv4 port $bittorrent_udp \ -> $toys_ipv4 port $bittorrent_udprdr on $ext_if \ inet proto tcp \ from any \ to $ext_ipv4 port $dcc \ -> $toys_ipv4 port $dccrdr on $ext_if \ inet proto tcp \ from any \ to $ext_ipv4 port $gnutella \ -> $toys_ipv4 port $gnutellardr on $ext_if \ inet proto tcp \ from any \ to $ext_ipv4 port $openft_http \ -> $toys_ipv4 port $openft_httprdr on $ext_if \ inet proto tcp \ from any \ to $ext_ipv4 port $openft_main \ -> $toys_ipv4 port $openft_mainanchor "ftp-proxy/*"anchor "authpf/*" in on $wlan_if# Block to/from illegal sources/destinationsblock quick inet6block in log quick from no-route to anyblock in log quick on $ext_if from <SLOWQUEUE> to any probability 97%block in quick on $ext_if from <BLACKLIST> to anyblock in quick on $ext_if from any to 255.255.255.255block return in quick on $wlan_if from any to <BLACKLIST>block return in quick on $wlan_if from any to 224.0.0.1# filter rulesblock log quick from <abusers>block all#*# allow outgoing packets to the internet#pass out on $ext_if proto tcp all flags S/SA modulate statepass out on $ext_if \ from $toys_ipv4 \ keep state \ queue (q_def, q_pri) \ label "wifi.vpn_from_toys $proto:$dstport"pass out on $ext_if \ from $pushpop_ipv4 \ keep state \ queue (q_def, q_pri) \ label "wifi.vpn_from_pushpop $proto:$dstport"pass out on $ext_if \ from $mi3_ipv4 \ keep state \ queue (q_def, q_pri) \ label "wifi.vpn_from_mi3 $proto:$dstport"pass out on $ext_if proto tcp from $ext_if to any \ $tcp_state \ queue (q_def, q_pri) \ label "extif_out_from_other $proto:$dstport"pass out on $ext_if proto { udp, icmp } all keep stateanchor "ftp-proxy/*"pass quick on lopass in on $ext_if \ to $toys_ipv4 \ label "wifi.vpn_to_toys $proto:$dstport"pass in on $ext_if \ to $pushpop_ipv4 \ label "wifi.vpn_to_pushpop $proto:$dstport"pass in on $ext_if \ to $mi3_ipv4 \ label "wifi.vpn_to_mi3 $proto:$dstport"antispoof quick for { lo, $wlan_if, $vpn_if}#pass in on $ext_if inet proto tcp from any to ($ext_if) \# port $tcp_services flags S/SA keep state#pass in quick on $wlan_if inet proto udp \# from <authpf_users> \# to $kwanza_ipv4 port domain $udp_state $wlan_if_STO \# label "wifi.named $proto:$dstport"##allow http connection to local serverpass in quick on $wlan_if inet proto tcp \ from ! <authpf_users> \ to $kwanza_ipv4 port http $tcp_state \ label "wifi.disallow.http $proto:$dstport"#allow (but limit) ssh connectionspass in quick on $wlan_if inet proto tcp \ from $wlan_if:network to $wlan_if port ssh \ $syn_state $ssh_STO \ label "wifi.allow.ssh $proto:$dstport"pass in quick on $ext_if \ inet proto tcp \ from any \ to $toys_ipv4 port $dcc \ $tcp_state \ label "toys.dcc $proto:$dstport"pass in quick on $ext_if \ inet proto tcp \ from any \ to $toys_ipv4 port $gnutella \ $tcp_state \ label "toys.gnutella $proto:$dstport"pass in quick on $ext_if \ inet proto tcp \ from any \ to $toys_ipv4 port $openft_main \ $tcp_state \ label "toys.openft_main $proto:$dstport"pass in quick on $ext_if \ inet proto tcp \ from any \ to $toys_ipv4 port $openft_http \ $tcp_state \ label "toys.openft_http $proto:$dstport"pass in quick on $ext_if \ inet proto tcp \ from any \ to $toys_ipv4 port $bittorrent_tcp \ $tcp_state \ queue q_tor_out \ label "toys.bittorrent_tcp $proto:$dstport"pass in quick on $ext_if \ inet proto udp \ from any \ to $toys_ipv4 port $bittorrent_udp \ $udp_state \ label "toys.bittorrent_udp $proto:$dstport"#####################################################################################