# VPN INTERFACE
ext_if = "tun0"

# PROVIDER ETHERNET INTERFACE
neo_if = "rl1"

# CLIENT INTERFACES 
rub_if = "rl0"
zta_if = "tun1"


int_if = "{rl0, tun1}"

# ALL INTERFACES
all_if = "{tun0, tun1, rl0, rl1, lo}"

set block-policy return

# ALLOWED OUTGOING PORTS
out_ports = "{21, 22, 80, 443, 5190, 8080, 6667}"

# ALLOWED HOSTS
allowed_hosts = "{192.168.197.0/24, 192.168.1.0/24}"

# NAT RULE
nat on $ext_if from $allowed_hosts to !192.168.0.0/16 -> ($ext_if:0)


# FILTER RULES

block all

# PASSING DNS
pass out on $ext_if inet proto {tcp,udp} from ns.mydomain to ns.provider port 53 keep state

# PASSING LOCAL
pass in on $int_if inet proto {tcp,udp} from $allowed_hosts to $int_if port 53 keep state

# PASSING OPENVPN TRAFFIC to PROVIDER
pass out on $neo_if inet proto {tcp,udp} from $neo_if to 192.168.130.1 port 5000 keep state

#PASSING TRAFFIC FROM VPN PEER
pass in on $neo_if inet proto {tcp,udp} from 192.168.8.12 to $neo_if port 5000 keep state

#PASSING ICMP
pass in on $all_if inet proto icmp all keep state
pass out on $all_if inet proto icmp all keep state