# VPN INTERFACE
ext_if = "tun0"

# PROVIDER ETHERNET INTERFACE
neo_if = "rl1"

# CLIENT INTERFACES 
rub_if = "rl0"
zta_if = "tun1"


int_if = "{rl0, tun1}"

# ALL INTERFACES
all_if = "{tun0, tun1, rl0, rl1, lo}"

set block-policy return

# ALLOWED OUTGOING PORTS
out_ports = "{21, 22, 80, 443, 5190, 8080, 6667}"

# ALLOWED HOSTS
allowed_hosts = "{192.168.197.0/24, 192.168.1.0/24}"

# NAT RULE
nat on $ext_if from $allowed_hosts to !192.168.0.0/16 -> ($ext_if:0)


# FILTER RULES

block all

# PASSING DNS
pass out on $ext_if inet proto {tcp,udp} from ns.mydomain to ns.provider port 53 keep state

# PASSING LOCAL
pass in on $int_if inet proto {tcp,udp} from $allowed_hosts to $int_if port 53 keep state

# PASSING OPENVPN TRAFFIC to PROVIDER
pass out on $neo_if inet proto {tcp,udp} from $neo_if to 192.168.130.1 port 5000 keep state

#PASSING TRAFFIC FROM VPN PEER
pass in on $neo_if inet proto {tcp,udp} from 192.168.8.12 to $neo_if port 5000 keep state

#PASSING ICMP
pass in on $all_if inet proto icmp all keep state
pass out on $all_if inet proto icmp all keep state


# IFCONFIG OUTPUT


# ifconfig -a
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 33224
        groups: lo
        inet 127.0.0.1 netmask 0xff000000
        inet6 ::1 prefixlen 128
        inet6 fe80::1%lo0 prefixlen 64 scopeid 0x6
rl0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
        lladdr 00:e0:7d:e5:f8:2b
        media: Ethernet autoselect (100baseTX full-duplex)
        status: active
        inet 192.168.197.1 netmask 0xffffff00 broadcast 192.168.197.255
        inet6 fe80::2e0:7dff:fee5:f82b%rl0 prefixlen 64 scopeid 0x1
rl1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
        lladdr 00:02:44:8f:7b:e9
        media: Ethernet autoselect (100baseTX full-duplex)
        status: active
        inet 192.168.130.4 netmask 0xfffffff8 broadcast 192.168.130.7
        inet6 fe80::202:44ff:fe8f:7be9%rl1 prefixlen 64 scopeid 0x2
pflog0: flags=0<> mtu 33224
pfsync0: flags=0<> mtu 1460
enc0: flags=0<> mtu 1536
tun0: flags=51<UP,POINTOPOINT,RUNNING> mtu 1450
        groups: tun egress
        inet xxx.xxx.xxx.xxx --> xxx.xxx.xxx.xxx netmask 0xfffffffc
tun1: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1500
        groups: tun
        inet 10.8.0.1 --> 10.8.0.2 netmask 0xffffffff