ext_if = "re0"
int_if = "rl0"
jls_if = "vlan0"

ext_ip = "192.168.1.1"
int_ip = "192.168.0.1"

rtr_ip = "192.168.1.254"

jails_ip = "10.0.0.0/8"
local_ip = "192.168.0.0/32"
mastr_ip = "192.168.1.0/32"

conn_attempts  = "3"
conn_timelimit = "5"

tcp_pass_in  = "{ 80 }"
tcp_pass_out = "{ 20 21 22 80 1002 10122 }"
udp_pass_in  = "{ 53 }"
udp_pass_out = "{ 53 }"

icmp_types = "echoreq"

###############

set block-policy return
set loginterface $ext_if
set skip on lo0

scrub in all

########### LAN

nat on $ext_if from $int_if:network to any -> ($ext_if)

# SSH
rdr pass on $ext_if proto tcp from any to $ext_ip port 59184 -> 10.0.0.2 port 22
rdr pass on $int_if proto tcp from $int_if:network to $ext_ip port 22 -> $ext_ip port 59184
rdr pass on $int_if proto tcp from $int_if:network to $ext_ip port 10022 -> 10.0.0.2 port 22
rdr pass on $int_if proto tcp from $int_if:network to $ext_ip port 10122 -> 10.0.0.3 port 22

# carbolymer
rdr pass on $ext_if proto tcp from any to $ext_ip port 10222 -> 10.0.0.4 port 22

# monika
rdr pass on $ext_if proto tcp from any to $ext_ip port 10322 -> 10.0.0.3 port 22

# przemek
rdr pass on $ext_if proto tcp from any to $ext_ip port 10422 -> 10.0.0.6 port 22

# ~~~~~~~~~~~~~~~~~ SQUID ~~~~~~~~~~~~~~~~~~~~

## www

rdr pass on { $int_if $ext_if } proto tcp from any to $ext_ip port 80 -> 10.0.0.2
rdr pass on $int_if proto tcp from any to $ext_ip port { 85 90 } -> 10.0.0.2

rdr on $int_if proto tcp from 192.168.0.0/24 to { any, !$ext_ip, !$rtr_ip } port 80 -> $ext_ip port 8080

########### JAILS

nat on $ext_if proto { icmp tcp } from $jails_ip to any -> $ext_ip

###########

block return log all

############

# PIOTREK

block out log quick on $int_if proto { tcp, udp } from 192.168.1.103 to any
pass out on $int_if proto tcp from 192.168.1.103 to any port { 21, 53, 80 }

# ADRIAN

block out log quick on $ext_if proto { tcp, udp } from 192.168.0.102 to any
block out log quick on $int_if proto { tcp, udp } from 192.168.0.102 to any
block in log quick on $ext_if proto { tcp, udp } from 192.168.0.102 to any
block in log quick on $int_if proto { tcp, udp } from 192.168.0.102 to any
#pass out log on $ext_if proto tcp from 192.168.1.102 to any port { 21, 53 }

##############

block out log quick on $ext_if proto tcp from 192.168.0.101 to any port 80

pass in quick on $ext_if from 192.168.1.1 to $jails_ip keep state
pass out quick on $ext_if from 192.168.1.1 to $jails_ip keep state

# Default policy from std in/out ports
#pass in quick on $ext_if proto tcp from any to $ext_ip port $tcp_pass_in keep state
#pass in quick on $ext_if proto udp from any to $ext_ip port $udp_pass_in keep state

#pass out on $int_if proto tcp from { $local_ip $jails_ip $mastr_ip } to any port $tcp_pass_out keep state
#pass out on $int_if proto udp from { $local_ip $jails_ip $mastr_ip } to any port $udp_pass_out keep state

# allow all traffic from internal network to internal interface
pass in  on $int_if from $int_if:network to any keep state
pass out on $int_if from any to $int_if:network keep state

# allow all traffic out via external interface
pass out on $ext_if proto tcp all modulate state flags S/SA
pass out on $ext_if proto { udp, icmp } all keep state