fastweb="xl0"

table <spamd> persist
table <spamd-white> persist

table <fw-dhcpd> persist { 41.5.120.1, 41.5.120.2, 41.5.120.3 }
table <fw-allow> persist { 41.19.150.66, 36.244.168.46 }
table <fw-bnc> persist { 41.19.150.66, 36.244.168.46 }

rfc_1918 = "{ 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8 }"

bnc = "{ 31337, 31338, 31339, 31340, 31341, 31341, 31342, 31343, 31344, 31345, 31346, 31347, 31348, 31349, 31350 }"

set skip on lo

set timeout { interval 10, frag 30 }
set block-policy drop 
set limit { frags 5000, src-nodes 10000, states 10000 }
set optimization normal
set state-policy if-bound
set loginterface $fastweb

scrub in  on $fastweb all fragment reassemble min-ttl 15 max-mss 1400
scrub out on $fastweb all random-id fragment reassemble 
scrub 	  on $fastweb all reassemble tcp


anchor "ftp-proxy/*"
block in
pass out keep state

block drop in quick on $fastweb inet from $rfc_1918 to any

antispoof quick for { lo }

#pass in quick proto esp from any to $fastweb
#pass in quick proto udp from any port = 500 to $fastweb port = 500 keep state
#pass in quick on enc0 all

pass in on $fastweb proto { tcp, udp } from <fw-dhcpd> to $fastweb  keep state
pass in on $fastweb proto tcp from <fw-allow> to ($fastweb) port ssh keep state
pass in on $fastweb proto tcp from <fw-bnc> to ($fastweb) port $bnc keep state