# Macros: define common values, so they can be referenced and changed easily.
pharm_if="bge0" # replace with actual external interface name i.e., dc0
tera_if="bge1" # replace with actual internal interface name i.e., dc1
pharm_net="128.248.0.0/16"
tera_net="192.168.1.0/24"
tera_ip="192.168.1.10"
gogol_ip="128.248.76.200"
adonis_ip="128.248.76.30"
xenopus_ip="128.248.76.29"
adonis_services="{21, 25, 80, 143 993}"
gogol_services="{21, 80, 137, 138, 139, 443, 515, 548, 873, 8080}"
icmp_types="echoreq"
#tables
table <bruteforce> persist
#set policies
set block-policy drop
set loginterface $pharm_if
#allow loopback
set skip on lo
# Normalization: reassemble fragments and resolve or reduce traffic ambiguitie
scrub in all
# NAT
nat on $pharm_if inet from $tera_if to any -> $gogol_ip
rdr pass on $pharm_if inet proto tcp from $pharm_net to $gogol_ip port $gogol_services -> $tera_ip
#binat on $pharm_if from $tera_if to any -> $web_serv_ext
# block all incoming by default, unless following rules allow the packet in
block in
block quick from <bruteforce>
#allow all outgoing packets
pass out keep state
#prevent spoofing on local network and localhost
antispoof quick for {lo $pharm_if }
# gogol rules
pass in on $pharm_if inet proto {tcp, udp} from $pharm_net to $tera_ip port $gogol_services flags S/SA keep state
#allow all traffic from internal hosts
pass in on $pharm_if from $pharm_net to $xenopus_ip
pass in on $pharm_if from $pharm_net to $adonis_ip
pass in on $tera_if from $tera_ip
#external services
pass in on $pharm_if inet proto tcp from any to $adonis_ip port $adonis_services flags S/SA keep state
pass in on $pharm_if inet proto {tcp, udp} from any to $adonis_ip port ssh flags S/SA keep state (max-src-conn 15, max-src-conn-rate 9/3, overload <bruteforc\
e> flush global)
#icmp
pass in inet proto icmp all icmp-type $icmp_types keep state