##########################################################
# Pf config by ZeR0^ the 20 august 2006 ##################
##########################################################


########
# Vars #
########

lan_if = "ed2"
net_if = "ed1"
loop = "lo0"

table <ip_net> { 192.168.0.252 }
table <ip_lan> { 10.0.0.100, 10.0.1.100, 10.0.2.100 }

table <vlan1> { 10.0.0.0/16 }
table <vlan2> { 10.0.1.0/16 }
table <vlan3> { 10.0.2.0/16 }

lan_tcp_services = "{ 161, 162, 53 }"
lan_udp_services = "{ 161, 162, 53 }"

net_tcp_services = "{ 22 }"
net_udp_services = ""

rdr_tuxed_tcp_services = "{ 80, 21, 8000, 6667, 6669 }"
rdr_tuxed_udp_services = ""

tuxed = "{ 10.0.1.110 }"
zero = "{ 10.0.2.44 }"
guru = "{ 10.0.1.50 }"


allow_port_vlan3 = "{ 80, 443, 25, 110, 6667, 6669 }"
allow_port_vlan2 = "{ 80, 443, 25, 21, 110, 6667, 6669, 3306, 6600><7000 }"
allow_port_vlan1 = "{ 80, 443, 25, 110, 6667, 6669, 7000, 21, 22, 53, 10000, 8080, 8000 }"
allow_port_ip = "{ 1><65000 }"
###########
# Options #
###########
set optimization aggressive
set fingerprints "/etc/pf.os"
set block-policy drop
set skip on loop
set timeout { interval 5, frag 15 }
set timeout { tcp.first 60, tcp.opening 30, tcp.established 86400 }
set timeout { tcp.closing 300, tcp.finwait 50, tcp.closed 90 }
set timeout { udp.first 60, udp.single 30, udp.multiple 60 }
set timeout { icmp.first 20, icmp.error 10 }
set timeout { other.first 60, other.single 30, other.multiple 60 }
set timeout { adaptive.start 0, adaptive.end 0 }
set limit { states 5000; frags 2500 }

##############
# IPv4 Rules #
##############
scrub in on $lan_if all fragment reassemble
scrub out on $lan_if all random-id fragment reassemble
nat on $lan_if inet from $net_if:network to any -> $lan_if
rdr on $lan_if inet proto tcp from $net_if to $lan_if port $rdr_tuxed_tcp_services -> $tuxed port $rdr_tuxed_tcp_serviceS
block log on { $net_if, $lan_if all
antispoof log quick for { $loop, $lan_if, $net_if }
block log quick from no-route to any
pass quick on $loop all

# secu protocoles tcp
block drop in quick log on $net_if proto tcp from any to any flags /S
block drop in quick log on $net_if proto tcp from any to any floags A/A
block drop in quick log on $net_if proto tcp from any to any flags FUP/FUP
block drop in quick log on $net_if proto tcp from any to any flags /SFRA
block drop in quick log on $net_if proto tcp from any to any flags SAFRU/SAFRU
block drop in quick log on $net_if proto tcp from any to any flags SF/SF
block drop in quick log on $net_if proto tcp from any to any flags SR/SR

# entrant
pass in quick on $lan_if inet proto udp from any to $lan_if:network port $lan_udp_services keep state (max 120, tcp.first 10)
pass in quick on $lan_if inet proto tcp from any to $lan_if:network port $lan_tcp_services keep state (max 120, tcp.first 10)
pass in quick on $net_if inet proto udp from any to $net_if:network port $net_udp_services keep state (max 120, tcp.first 10)
pass in quick on $net_if inet proto tcp from any to $net_if:network port $net_tcp_services keep state (max 120, tcp.first 10)
# sortant
pass out quick on $net_if inet proto tcp from <vlan1> to any port $allow_port_vlan1 keep state
pass out quick on $net_if inet proto tcp from <vlan2> to any port $allow_port_vlan2 keep state
pass out quick on $net_if inet proto tcp from <vlan3> to any port $allow_port_vlan3 keep state
pass out quick on $net_if inet proto tcp from $tuxed to any port $allow_port_ip keep state
pass out quick on $net_if inet proto tcp from $zero to any port $allow_port_ip keep state

# tout le reste
block drop in log quick on { $lan_if, $net_if } all

##############
# IPv6 Rules #
##############
pass in quick on stf0 all
pass out quick on stf0 all
pass out quick proto ipv6 from any to any keep state
pass out quick proto ipv6-icmp from any to any keep state
pass in quick proto ipv6-icmp from any to any