# $OpenBSD: pf.conf,v 1.31 2006/01/30 12:20:31 camield Exp $
#
# See pf.conf(5) and /usr/share/pf for syntax and examples.
# Remember to set net.inet.ip.forwarding=1 and/or net.inet6.ip6.forwarding=1
# in /etc/sysctl.conf if packets are to be forwarded between interfaces.
ext_if="le0"
int_if="hme1"
set optimization aggressive
set loginterface $ext_if
set block-policy drop
scrub in
#nat on $ext_if from !($ext_if) -> ($ext_if:0)
nat on le0 from hme2:network to any -> (le0)
# Bit Torrent redirect/pass rule
rdr pass on $ext_if proto tcp from any to any port 6881:6889 -> 192.168.12.11
rdr pass on $ext_if proto udp from any to any port 6881 -> 192.168.12.11 port 6881
#same for freenet
rdr pass on $ext_if proto udp from any to any port 26997 -> 192.168.12.11
# shareaza redirect/pass rule
rdr pass on $ext_if proto tcp from any to any port 6346 -> 192.168.12.11 port 6346
rdr pass on $ext_if proto udp from any to any port 6346 -> 192.168.12.11 port 6346
# emule
rdr pass on $ext_if proto tcp from any to any port 14147 -> 192.168.12.11 port 14147
rdr pass on $ext_if proto udp from any to any port 49617 -> 192.168.12.11 port 49617
# counterstrike server rdr/pass
rdr pass on $ext_if proto tcp from any to any port 27016 -> 192.168.12.11 port 27016
rdr pass on $ext_if proto udp from any to any port 27016 -> 192.168.12.11 port 27016
rdr pass on $ext_if proto tcp from any to any port 27015 -> 192.168.12.11 port 27015
rdr pass on $ext_if proto udp from any to any port 27015 -> 192.168.12.11 port 27015
#pass for webserver
pass in quick proto tcp to any port www keep state
pass in quick proto tcp to any port https keep state
### BLOCK ###
#Block cable modem broadcasts.
block in log quick on $ext_if from any to 255.255.255.255
#default block rule
block in log on $ext_if from any to any
#block spoofs
antispoof log for { lo $int_if }
### OUT ###
# statefully allow traffic out
pass out keep state flags S/SA
#start to pass things. here's web
pass out on $ext_if proto tcp from any port http keep state
#dns out, keeping state
pass out on $ext_if proto udp from any port domain keep state
#here's ICMP, we keep the state to allow return pings
pass out on $ext_if proto icmp keep state
### IN ###
#pass in DNS
pass in on $ext_if proto udp to any port domain
#pass in SSH
pass in on $ext_if proto tcp to ($ext_if) port ssh keep state
#pass in identd
pass in on $ext_if proto tcp to ($ext_if) port auth keep state
#pass to tor from myself
pass in on lo proto tcp to lo port 9050 keep state