# keep established connection alive
00001 check-state
# security purpose input connection from WAN are denied.
00010 deny log ip from me to any in recv rl0
# loopback
00020 allow ip from any to any via lo0 keep-state
# NAT
00030 divert 8668 ip from any to any via rl0
# this one allowed my to ping the router from a client computer, but nothing else, should not be required I think though.
00040 allow ip from 10.23.200.0/24 to any keep-state
# 50 - 130 : DHCP
00050 allow udp from 10.23.200.0/24 68 to me dst-port 67 in keep-state
00060 allow udp from 121.83.130.32/29 68 to me dst-port 67 in keep-state
00070 allow udp from 10.23.100.0/24 68 to me dst-port 67 in keep-state
00080 allow udp from 0.0.0.0 68 to me dst-port 67 in keep-state
00090 allow udp from any 68 to 255.255.255.255 dst-port 67 keep-state
00100 allow udp from me 67 to 10.23.200.0/24 dst-port 68 out keep-state
00110 allow udp from me 67 to 121.83.130.32/29 dst-port 68 out keep-state
00120 allow udp from me 67 to 10.23.100.0/24 dst-port 68 out keep-state
00130 allow udp from me 67 to 255.255.255.255 dst-port 68 out keep-state
# rules 170 to 190 was from me to any, but since the NAT is not working I changed it to any to any. but then these rules were shadowing 200-230 and thus allowing to many connections to my router, so I added the skipto on 140-160.
00140 skipto 200 icmp from any to me icmptypes 8 in
00150 skipto 200 tcp from any to me dst-port 22,80,443,21,20,25,53 in
00160 skipto 200 udp from any to me dst-port 53 in
00170 allow icmp from any to any icmptypes 8 keep-state
00180 allow tcp from any to any dst-port 22,80,443,21,20,25,53 setup keep-state
00190 allow udp from any to any dst-port 53 keep-state
# 200-230 allowed connection to my router
00200 allow icmp from any to me icmptypes 0,3,11 in keep-state
00210 allow tcp from any 20 to me dst-port 1024-65535 in setup keep-state
00220 allow tcp from any to me dst-port 22 in setup keep-state
00230 allow udp from any to me dst-port 1194 in keep-state
# deny everything else
00240 deny log ip from any to any
00250 deny ip from any to any
65535 deny ip from any to any