pf.conf

ext_if="xl0"
int_if="xl1"

icmp_types="echoreq"

galene="134.106.53.73"
cifs="{ netbios-ns, netbios-dgm, netbios-ssn, microsoft-ds }"

table <bruteforce> persist

set block-policy return
#set loginterface $ext_if

set skip on lo

scrub in on xl0 all
scrub in on xl1 all no-df

nat on $ext_if from !($ext_if) to any -> ($ext_if)

rdr proto tcp from any to { ($ext_if), ($int_if) } port 2500 -> $galene port smtp

block in quick from no-route to any
block in log all

pass out all keep state

antispoof quick for { lo $int_if }

pass in quick on $int_if keep state

pass  inet proto { tcp, udp } from any to $ext_if port ssh \
    flags S/SA keep state \
    (max-src-conn 15, max-src-conn-rate 5/3, \
     overload <bruteforce> flush global)

pass in on $ext_if inet proto tcp from any to ($ext_if) port http \
    flags S/SA synproxy state
pass in on $ext_if inet proto tcp from any to ($ext_if) port ftp \
    flags S/SA keep state

pass in on $ext_if inet proto tcp from any to $galene port smtp \
    flags S/SA keep state

pass in on $ext_if inet proto { tcp, udp } from any to ($ext_if:network) port ipp \
    flags S/SA keep state

pass in on $ext_if inet proto { tcp, udp } from any to ($ext_if:network) port $cifs \
    flags S/SA keep state

pass in inet proto icmp all icmp-type $icmp_types keep state