# Tables
table <me> const { self }
#table <bruteforce> persist file "/var/db/ssh-bruteforce"
table <admins> const { 0.0.0.0 }
#table <ircd> const { }
# Normalization
scrub all
altq on vr0 priq bandwidth 100Mb queue { ssh, irc, web, vpn, other }
queue ssh priority 1
queue irc priority 2
queue web priority 3
queue vpn priority 4
queue other priority 5 priq(default)
# Defaults
block in all
pass quick on lo0 keep state
pass quick on tun0 keep state
#pass out quick proto tcp all flags S/SA keep state queue other
#pass out quick proto udp all keep state queue other
#pass out quick proto icmp all keep state queue other
#pass out quick all keep state
# ICMP
pass in inet proto icmp all icmp-type { 0,3,11 } keep state
pass out quick proto icmp all keep state
# DNS
pass in proto { tcp udp } from any to 65.23.153.37 port domain keep state
pass out proto { tcp udp } from any to any port domain keep state
# Ident
pass in proto tcp to <me> port ident keep state
pass out proto tcp to <me> port ident keep state queue irc
# WWW
pass in proto tcp to <me> port { 80 443 2222 10000 } keep state
pass out proto tcp to <me> port { 80 443 2222 10000 } keep state queue web
# IRC
pass in proto tcp from any to 65.23.153.144 port 6969 keep state
pass in proto tcp from any to 65.23.153.144 port 6697 keep state
pass in proto tcp from any to 65.23.153.144 port 7110 keep state
pass out proto tcp from any to any port 6969 keep state queue irc
pass out proto tcp from any to any port 6697 keep state queue irc
pass out proto tcp from any to any port 7110 keep state queue irc
# FTP
pass in proto tcp to <me> port { 20 ftp } keep state
pass in proto tcp to <me> port 49151 >< 65535 keep state
pass out proto tcp to <me> port { 20 ftp } keep state queue other
pass out proto tcp to <me> port 49151 >< 65535 keep state queue other
# SVN
pass in proto { tcp udp } to <me> port 3690 keep state
pass out proto { tcp udp } to <me> port 3690 keep state queue ssh
# MAIL
pass in proto tcp to <me> port { pop3 smtp imap } keep state
# pass in proto tcp to <me> port { 993 465 } keep state
pass out proto tcp to <me> port { pop3 smtp imap } keep state queue other
pass out proto tcp to any port smtp keep state queue other
# SSH
pass in proto tcp to <me> port ssh keep state
block in log quick proto tcp from <bruteforce> to any port ssh
pass out proto tcp to <me> port ssh keep state queue ssh
pass in proto tcp to <me> port telnet keep state
pass in proto tcp from <admins> to <me> keep state
# VPN
pass in proto udp to <me> port 1194 keep state
pass out proto udp to <me> port 1194 keep state queue vpn
pass out quick all keep state