# pf.conf for avvio.com.br
#
# By flambers <flambers@flambers.com>
# Fri Apr 4 11:19:06 BRT 2008
###
### Macros
###
# interfaces
ext_if = "xl0"
int_if = "bge0"
# ips
ext_ip = "200.160.74.107"
internal_lan = "10.0.0.0/24"
ssh_port = "2323"
allowed_ssh = "{ \
10.0.0.10, \
10.0.0.15, \
10.0.0.113, \
201.63.116.3, \
10.0.0.0/24 \
}"
###
### Options, scrub, rdr and nat
###
# options
set skip on lo0
set block-policy drop
# scrub
scrub all
# nat for internal lan
nat log on $ext_if from $internal_lan to any -> $ext_ip
# ftp-proxy for internal lan
rdr on $int_if proto tcp from $internal_lan port ftp -> 127.0.0.1 port 8021
# nat and proxy
nat-anchor "ftp-proxy/*"
anchor "ftp-proxy/*"
###
### Filter rules
###
# spoofed address protection
antispoof log quick for { lo0, $int_if, $ext_if } inet
# default policy
block log all
# block nmap os
block in log quick from any os "NMAP OS"
# allow icmp for all
pass in log quick on $int_if proto icmp from $internal_lan to any icmp-type echoreq keep state
pass out log quick inet proto icmp all
# allow access to fw from internal lan
pass log quick on $int_if proto { tcp, udp } from $internal_lan to $int_if keep state
# rules from internal lan
pass in log on $int_if inet proto { tcp, udp } from $internal_lan to any keep state
pass out log on $int_if inet proto { tcp, udp } from any to $internal_lan keep state
# rules to fw ext_ip
pass out log on $int_if inet proto { tcp, udp } from $int_if to any keep state
pass out log on $ext_if inet proto { tcp, udp } from $ext_ip to any keep state