#########
# MACROS #
##########
int_if = "rl1"
ext_if = "rl0"
ipv6_if = "gif0"
ipv6_net = "{ 3ffe:80ee:3a17:0:0:0:0:0/48 }"
ipv6_pop = "195.28.165.254"
comp1 = "192.168.1.103"
good_ports = "{ 1025,6881:6889,10000:60000 }"
tcp_services = "{ 22,80,113 }"
icmp_types = "echoreq"

priv_nets = "{ 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8, 255.255.255.255/32 }"
  
bad_ports = "{ 69,135,137,138,139,445,524,548,1433,6000,31337,666,12345 }"

table <bruteforce> persist
  

###########
# Options #
###########
set block-policy return
set loginterface $ext_if
set skip on lo0
  
#########
# SCRUB #
########## normalizacja datagramow
scrub in
  
########
# ALTQ #
########
# altq na wewn?etrznym interfejsie.
altq on $int_if cbq bandwidth 6Mb queue { ssh_in, mail_in, www_in, rest_in }
queue ssh_in bandwidth 500Kb priority 7
queue mail_in bandwidth 1500Kb cbq priority 3 {mail_smtp_in,mail_pop3_in}
queue mail_smtp_in bandwidth 600Kb cbq(borrow)
queue mail_pop3_in bandwidth 900Kb cbq(borrow)
queue www_in bandwidth 2Mb priority 5 cbq(borrow)
queue rest_in bandwidth 2Mb priority 1 cbq(borrow default)
  
# altq na zewn?etrznym interfejsie
altq on $ext_if cbq bandwidth 370Kb queue { ssh_out, mail_out, www_out, rest_out }
queue ssh_out bandwidth 40Kb priority 7
queue mail_out bandwidth 80Kb priority 3 {mail_smtp_out,mail_pop3_out}
queue mail_smtp_out bandwidth 30Kb cbq(borrow)
queue mail_pop3_out bandwidth 50Kb cbq(borrow)
queue www_out bandwidth 150Kb priority 5 cbq(borrow)
queue rest_out bandwidth 100Kb priority 1 cbq(borrow default)
  
  
###########
# NAT/RDR #
###########
nat on $ext_if from $int_if:network to any -> ($ext_if)
nat-anchor "ftp-proxy/*"
rdr-anchor "ftp-proxy/*"
rdr pass on $int_if proto tcp from any to any port 21 -> 127.0.0.1 \
   port 8021
rdr on $ext_if proto {tcp, udp} from any to any port $good_ports -> $comp1

# regulki filtra pakietow
block in

pass quick on lo0 all

anchor "ftp-proxy/*"
antispoof quick for { lo $int_if }
  
# block the ssh bruteforce bastards
block drop in quick on $ext_if from <bruteforce>

# block bad ports and external broadcasts
block in quick  proto { udp,tcp }  from any to any port $bad_ports
block in quick  on $ext_if         from any to 255.255.255.255

pass in quick on $ext_if inet proto {tcp, udp} from any to any port domain keep state

pass in quick on $ext_if proto {tcp, udp} from any to $comp1 port $good_ports \
   flags S/SA synproxy state
  
block  in  quick on $ext_if from $priv_nets to any
block  out quick on $ext_if from any to $priv_nets
  
pass in on $ext_if inet proto tcp from any to ($ext_if) \
   port $tcp_services flags S/SA keep state

#serv_ftp
#pass in on $ext_if proto tcp from any to any port 21 keep state
#pass in on $ext_if proto tcp from any to any port > 49151 \
#   keep state
  
pass in inet proto icmp all icmp-type $icmp_types keep state

pass in  on $int_if from $int_if:network to any keep state
#pass out on $int_if from any to $int_if:network keep state

pass out on $ext_if proto tcp all modulate state flags S/SA
pass out on $ext_if proto { udp, icmp } all keep state

pass out on $ext_if inet proto ipv6 from $ext_if to $ipv6_pop keep state
pass in on $ext_if inet proto ipv6 from $ipv6_pop to $ext_if keep state
pass out on $ipv6_if inet6 all keep state
pass in on $ipv6_if inet6 all keep state

## no linux please on protected ports
#block in quick on $ext_if inet proto tcp from any os Linux to any port $protected

# special rule for ssh
pass in on $ext_if proto tcp from any to ($ext_if) port ssh \
        flags S/SA keep state \
 pass out on $ext_if proto tcp from any to any flags S/SA \
modulate state queue (rest_out, ssh_out)
#pass out on $ext_if inet proto tcp from any to any 22 flags S/SA keep state queue (rest_out, ssh_out)
#pass out on $ext_if inet proto tcp from any to any port 25\
#flags S/SA modulate state queue mail_smtp_out
#pass out on $ext_if inet proto tcp from any to any port 110\
#flags S/SA modulate state queue mail_pop3_out
pass out on $ext_if inet proto tcp from any to any port 80 \
flags S/SA modulate state queue www_out
pass out on $int_if inet proto tcp from any port 80 to any \
queue www_in
pass out on $int_if inet proto tcp from any port 22 to any \
queue (rest_in, ssh_in)
#pass out on $int_if inet proto tcp from any port to any 25 queue mail_smtp_in
pass out on $int_if inet proto tcp from any port 110 to any queue mail_pop3_in       (max-src-conn-rate 2/20, overload <bruteforce> flush global)