# kermit's /etc/pf.conf

# interfaces
riv_if="sis0"
net_if="sis1"
int_if="sis2"

antares = "10.90.0.1"
frog = "10.0.0.2"

# internet shares
table <shares> const file "/etc/pf.shares"
 
# open services
services_riv = "{ ftp, ssh, smtp, www, https, imaps, 6668 }"
services_net = "{ ssh, smtp, www, https, imaps, 6668 }"

### script begins here
# scrub incoming packets
scrub in all

## nat rules

# nat on internet for local network and shares
nat pass on $net_if from $int_if:network to any -> $net_if
nat pass on $net_if from <shares> to any -> $net_if
# nat on riverotte from local network
nat pass on $riv_if from $int_if:network to $riv_if:network -> $riv_if

# redirect open services to frog 
rdr pass on $riv_if proto tcp from $riv_if:network to $riv_if \
  port $services_riv -> $frog
rdr pass on $net_if proto tcp from any to $net_if \
  port $services_net -> $frog

# redirect irc to antares
rdr pass on $net_if proto tcp from any to any \
  port { 6667, 9999 } -> $antares

## filtering rules
# standard behavior : block all, allow localhost
block all
block return in quick on { $net_if, $riv_if } proto tcp \
  from any to any port 113
pass quick on lo0 all
antispoof quick for lo0

# allow ssh from local network 
pass in on $int_if inet proto tcp from $int_if:network to $int_if \
  port ssh flags S/SA keep state 

# allow echo request icmp and dns (from internal, internet and shares)
pass in inet proto icmp all icmp-type echoreq keep state
pass in on $net_if inet proto { tcp, udp } \
  from any to $net_if port 53 keep state
pass in on $int_if inet proto udp \
  from $int_if:network to $int_if port 53 keep state 
pass in on $riv_if inet proto udp \
  from <shares> to $riv_if port 53 keep state

# allow traffic from local network to internet
pass in on $int_if from $int_if:network to any keep state
#pass in on $riv_if from <shares> to any keep state
pass out on $net_if all keep state
pass out on $riv_if all keep state

# eof