### {...} - means a set of IPs
table <ssh> persist {...}
table <bgp> persist {...}
table <lan> persist {...}
table <ftp_ssh> persist {...}
table <denyall> persist
set skip on lo
set skip on vlan1
set timeout tcp.first 120
set timeout tcp.established 86400
set timeout { adaptive.start 26000, adaptive.end 48000 }
set limit states 100000
scrub in
### redirect old mail's ip
rdr pass proto tcp to xx.xx.xx.79 port 110 -> yy.yy.yy0.133 port 110
rdr pass proto tcp to xx.xx.xx.79 port 143 -> yy.yy.yy0.133 port 143
rdr pass proto tcp to xx.xx.xx.79 port 993 -> yy.yy.yy0.133 port 993
rdr pass proto tcp to xx.xx.xx.79 port 995 -> yy.yy.yy0.133 port 995
nat from yy.yy.yy0.10 to any port 25 -> yy.yy.yy0.131
block in log
pass out
pass quick on { vlan1 } proto pfsync
pass on { em0 vlan1 } proto carp
block in quick from <denyall> to any
block quick proto {tcp, udp} from xx.xx.xx.74 to any port {1433,1434}
### ICMP and traceroute from any to any
pass in proto icmp
pass in proto udp from any to any port 33434:33534
pass in proto tcp from <ssh> to any port 22 no state
pass out proto tcp from any port 22 to <ssh> no state
pass in proto tcp from <bgp> to <bgp> port 179
pass in from any to {yy.yy.yy1.0/24, xx.xx.xx.0/24} no state
pass out from {yy.yy.yy1.0/24, xx.xx.xx.0/24} to any no state
pass in proto tcp from any to {yy.yy.yy2.0/23, xx.xx.xx.0/24} port {80,443} no state
pass out proto tcp from {yy.yy.yy2.0/23, xx.xx.xx.0/24} port {80,443} to any no state
pass in proto tcp from any to <ftp_ssh> port 22 no state
pass out proto tcp from <ftp_ssh> port 22 to any no state
pass in proto {tcp,udp} from any to yy.yy.yy0.5 port 53
##################################################
############ Replica from old FW #################
##################################################
pass in proto tcp from any to xx.xx.xx.66 port 80 no state
pass out proto tcp from xx.xx.xx.66 port 80 to any no state
pass in proto tcp from any to xx.xx.xx.68 port {80,443}
pass in proto tcp from {...} to xx.xx.xx.68 port {1723,3389}
pass in proto gre from {...} to xx.xx.xx.68
pass in proto tcp from any to xx.xx.xx.71 port {21,22,80,443,49152:65535} no state
pass out proto tcp from xx.xx.xx.71 port {21,22,80,443,49152:65535} to any no state
pass in proto tcp from any to xx.xx.xx.72 port {21,80,443,49152:65535} no state
pass out proto tcp from xx.xx.xx.72 port {21,80,443,49152:65535} to any no state
pass in proto tcp from any to xx.xx.xx.74 port {25,80,443}
pass in proto tcp from {...} to xx.xx.xx.74 port {3389,5631,5800,5900}
pass in proto tcp from {...} to xx.xx.xx.74 port 1723
pass in proto gre from {...} to xx.xx.xx.74
pass in proto tcp from any to xx.xx.xx.75 port {21,22,25,80,443,49152:65534}
pass in proto tcp from any to xx.xx.xx.81 port {80,443}
#pass in proto tcp from any to {xx.xx.xx.96, xx.xx.xx.97} port {80,443}
pass in from zz.zz.zz.3 to {xx.xx.xx.76,xx.xx.xx.77,xx.xx.xx.83,xx.xx.xx.85,yy.yy.yy0.33}
#pass out from {xx.xx.xx.76,xx.xx.xx.77,xx.xx.xx.83,xx.xx.xx.85,yy.yy.yy0.33} to zz.zz.zz.3 no state
pass in proto tcp from any to {xx.xx.xx.76,xx.xx.xx.77,xx.xx.xx.83,xx.xx.xx.85,yy.yy.yy0.33} port {21,22,80,1024:65535}
#pass out proto tcp from {xx.xx.xx.76,xx.xx.xx.77,xx.xx.xx.83,xx.xx.xx.85,yy.yy.yy0.33} port {21,22,80,1024:65535} to any no state
pass in proto tcp from any to xx.xx.xx.79 port {25,2525, 80,443, 110,143,993,995}
### smtp
pass in proto tcp from any to yy.yy.yy0.131 port {25,2525}
pass in proto tcp from any to yy.yy.yy0.132 port {25,2525}
### pop3
pass in proto tcp from any to yy.yy.yy0.133 port {25,2525, 80,443, 110,143,993,995}
pass in proto tcp from any to xx.xx.xx.80 port {80,443}
pass in proto tcp from {...} to xx.xx.xx.80 port 5432 no state
pass out proto tcp from xx.xx.xx.80 port 5432 to {...} no state
pass in from zz.zz.zz.155 to xx.xx.xx.84
pass in proto tcp from any to xx.xx.xx.84 port {25,80,443}
pass in proto tcp from {...} to xx.xx.xx.84 port {3389,5631,5800,5900}
pass in proto tcp from {...} to xx.xx.xx.84 port {1723,3389}
pass in proto gre from {...} to xx.xx.xx.84
pass in proto tcp from any to xx.xx.xx.84 port {1723,3389}
pass in proto gre from any to xx.xx.xx.84
pass in proto tcp from any to xx.xx.xx.86 port {25,80,443}
pass in proto tcp from {...} to xx.xx.xx.86 port {3389,5631,5800,5900}
pass in proto tcp from {...} to xx.xx.xx.86 port {1723,3389}
pass in proto gre from {...} to xx.xx.xx.86
pass in proto tcp from any to xx.xx.xx.88 port {25,80,443}
pass in proto tcp from {...} to xx.xx.xx.88 port {3389,5631,5800,5900}
pass in proto tcp from {...} to xx.xx.xx.88 port {1723,3389}
pass in proto gre from {...} to xx.xx.xx.88
pass in proto tcp from any to xx.xx.xx.90 port {21,22,80,49152:65535}
pass in proto tcp from any to xx.xx.xx.91 port {80}
pass in proto tcp from any to xx.xx.xx.92 port {21,22,80,49152:65535}
pass in proto tcp from any to xx.xx.xx.98 port {80,443}
pass in proto tcp from any to xx.xx.xx.99 port {80,443}
pass in proto tcp from any to xx.xx.xx.100 port {25,110,143,993,995}
pass in proto tcp from any to yy.yy.yy0.129 port 25
pass in proto tcp from any to yy.yy.yy0.130 port {25,110,143,993,995}
### devel VPS (sftp)
pass in proto tcp from any to xx.xx.xx.107
###################################################
################# New Range #######################
###################################################
### voipgw
pass in proto udp from {...} to yy.yy.yy0.7 port {5060, 11000:12000}
pass in proto udp from {...} to yy.yy.yy0.7
pass in proto tcp from {cc.cc.cc.6, cc.cc.cc.7, cc.cc.cc.8} to yy.yy.yy0.11 port 22
pass in proto tcp from any to yy.yy.yy0.11 port {80,443}
pass in proto tcp from {...} to yy.yy.yy0.11 port 5432
pass in proto tcp from any to yy.yy.yy0.12 port {80}
pass in proto tcp from any to yy.yy.yy0.12 port {25,110,143}
pass in proto tcp from any to yy.yy.yy0.135 port {21,22,80,443,49152:65534}
pass in proto tcp from any to yy.yy.yy0.136 port {21,80,443,49152:65534}
pass in proto tcp from any to yy.yy.yy0.138 port {21,22,80,443,49152:65534}