Proxy# cat /etc/pf.rules
#############################pf rules for marucom proxy###############
ext_if="fxp2  #outbound interface
int_if=fxp0  #inbound interface

pass in all

####skip filter loopback######
set skip on lo0

# Normalization: reassemble fragments and resolve or reduce traffic ambiguities.
scrub in all

rdr on $int_if inet proto tcp from any to any port 80 -> 127.0.0.1 port 3128



pass out quick on $ext_if inet proto tcp from any to any port 80 keep state
pass out quick on $ext_if proto tcp from $ext_if to any flags S/SA \

# allow ssh in, but limited to 5 attempts in 60 seconds before a ban is imposed on the connecting ip address.
pass in quick on $int_if proto tcp from any to $int_if port 22 flags S/SA keep state (max-src-conn-rate 5/60, overload <bruteforce> flush global)
pass in quick on $ext_if proto tcp from any to $ext_if port 22 flags S/SA keep state (max-src-conn-rate 5/60, overload <bruteforce> flush global)

pass in quick log on $int_if proto { tcp, udp } from 192.168.2.0/24 keep state
pass in quick log on $int_if proto { tcp, udp } from 192.168.5.0/24 keep state