#216.16.215.115  = mail
#216.16.215.107 = cube
tunnelendv4=216.218.224.42
ext_if="fxp0"
v6_if="gif0"
addr_1="216.16.215.115"
addr_1_tcp="{ 25 80 110 44337 55055 }"
addr_1_udp="{ 53 }"
addr_2="216.16.215.107"
addr_2_tcp="{ 22 53 80 113 6667 6697 7029 57000 }"
addr_2_udp="{ 53 113 }"
set timeout { interval 10, frag 30 }
set timeout { tcp.first 120, tcp.opening 30, tcp.established 86400 }
set timeout { tcp.closing 300, tcp.finwait 30, tcp.closed 45 }
set timeout { udp.first 60, udp.single 30, udp.multiple 60 }
set timeout { icmp.first 20, icmp.error 10 }
set timeout { other.first 60, other.single 30, other.multiple 60 }
set timeout { adaptive.start 0, adaptive.end 0 }
set limit { states 10000, frags 5000 }
set loginterface none
set optimization normal
set block-policy drop
set require-order yes
set fingerprints "/etc/pf.os"
set skip on lo0
set skip on ed0
scrub in all
pass in on $ext_if inet proto ipv6 all keep state
pass out on $ext_if inet proto ipv6 all keep state
block in log all
table <sshguard> persist
table <apachedos> persist
block in quick on $ext_if from <sshguard> label "ssh bruteforce"
block in quick on $ext_if from <apachedos> label "apache dos"
#pass in all
pass out all
#pass in quick on $ext_if proto ipv6 all
#pass out quick on $ext_if proto ipv6 all
#pass in on $ext_if proto tcp to $tunnel_end4 \
#port 113 modulate state \
#(max-src-conn 50, max-src-conn-rate 10/10, overload <apachedos> flush) 

pass out on $ext_if proto { tcp, udp } all keep state
pass in on $ext_if proto tcp from any to $addr_1 port $addr_1_tcp keep state
pass in on $ext_if proto udp from any to $addr_1 port $addr_1_udp keep state
pass in on $ext_if proto tcp from any to $addr_2 port $addr_2_tcp keep state
pass in on $ext_if proto udp from any to $addr_2 port $addr_2_udp keep state