#############################################
#                               MACROS
#############################################
# macros for interfaces
ext_if="nfe0"
lan_if="re0"
# networks

### Hosts
 isengard ="10.0.1.100"
 bt ="10.0.1.101"

### Queues, States and Types ###
 IcmpType ="icmp-type 8 code 0"
 SshQueue ="(ssh_bulk, ssh_login)"
 SynState ="flags S/SAFR synproxy state"
 TcpState ="flags S/SAFR modulate state"
 UdpState ="keep state"

### Stateful Tracking Options (STO) ###
 FtpSTO   ="(tcp.established 7200)"
 ext_ifSTO ="(max 9000, source-track rule, max-src-conn   2000, max-src-nodes 14)"
 IntIfSTO ="(max 150,  source-track rule, max-src-conn   50,   max-src-nodes 14, max-src-conn-rate 75/20)"
 SmtpSTO  ="(max 200,  source-track rule, max-src-states 50,   max-src-nodes 50, max-src-conn-rate 30/10,   overload <BLOCKTEMP> flush global)"
 SshSTO   ="(max 5,    source-track rule, max-src-states 5,    max-src-nodes 5,  max-src-conn-rate  5/60)"
 WebSTO   ="(max 500,  source-track rule, max-src-states 50,   max-src-nodes 75, max-src-conn-rate 120/100, overload <BLOCKTEMP> flush global)"

# internal services
#$int_tcpPorts="{ 5801, 5901 }"
tcp_ports="{ ssh, www, 81 }"

isengard_ports="{ 6112, 51333 }"
#isengard_tcp_ports="{ 5800, 5900, 8000 }"

#############################################
#                               OPTIONS
#############################################

### Misc Options
 set debug urgent
 set reassemble yes
 set require-order yes
 set block-policy drop
 set loginterface $ext_if
 set state-policy if-bound
 set fingerprints "/etc/pf.os"
 set ruleset-optimization none

### Timeout Options
 set optimization aggressive
 set timeout { frag 30, tcp.established 120 }
 set timeout { tcp.first 30, tcp.closing 30, tcp.closed 30, tcp.finwait 30 }
 set timeout { udp.first 30, udp.single 30, udp.multiple 30 }
 set timeout { other.first 30, other.single 30, other.multiple 30 }

#############################################
#                               QUEUE
#############################################
 altq on $ext_if bandwidth 750Kb hfsc queue { ack, dns, norm, bulk }
  queue ack        bandwidth 30% priority 8 qlimit 500 hfsc (realtime   20%, ecn   )
  queue dns        bandwidth 5%  priority 7 qlimit 500 hfsc (realtime   5%         )
  queue ssh        bandwidth 20% priority 6 qlimit 500 hfsc (realtime   20%) {ssh_login, ssh_bulk}
   queue ssh_login bandwidth 50% priority 6 qlimit 500 hfsc
   queue ssh_bulk  bandwidth 50% priority 5 qlimit 500 hfsc
  queue norm       bandwidth 20% priority 5 qlimit 500 hfsc (realtime   20%        )
  queue bulk       bandwidth 1%  priority 2 qlimit 500 hfsc (upperlimit 95% default)

#############################################
#                               RULES
#############################################
 antispoof log quick for { lo $lan_if ($ext_if) }
 block log quick inet6

 block in log quick on $ext_if inet           from any to 255.255.255.255
 block in log quick on $ext_if inet           from urpf-failed to any
 block in log quick on $ext_if inet           from no-route to any

 block        log on $ext_if
 block return log on $lan_if

#############################################
#                               SCRUB/NAT/RDR
#############################################

 match out log on egress from  (self)   to any               tag EGRESS nat-to ($ext_if:0) port 1024:65535
 match out log on egress from any to any received-on $lan_if tag EGRESS nat-to ($ext_if:0) port 1024:65535
 match out log on egress from $bt to any received-on $lan_if tag BITTOR nat-to ($ext_if:0) static-port

 match log on $ext_if all scrub (random-id min-ttl 254 set-tos lowdelay reassemble tcp max-mss 1472)

### $ext_if inbound 
 pass in log on $ext_if      proto tcp  from any        to ($ext_if) port $tcp_ports
 pass in log on $ext_if      proto tcp  from any        to ($ext_if) port $isengard_ports rdr-to $isengard
 pass in log on $ext_if      proto udp  from any        to ($ext_if) port $isengard_ports rdr-to $isengard
 pass in log on $ext_if inet proto icmp from !($ext_if) to ($ext_if) $IcmpType $UdpState

### $lan_if outbound
 pass out log on $lan_if inet proto tcp  from $lan_if to $lan_if:network port ssh $TcpState
 pass out log on $lan_if inet proto icmp from $lan_if to $lan_if:network $IcmpType $UdpState

### $lan_if inbound
 pass  in log on $lan_if
 match in log on $lan_if proto tcp from $lan_if:network to any port 80 rdr-to 127.0.0.1 port 3128

### $ext_if outbound
 pass out log on $ext_if inet proto tcp  from ($ext_if) to !($ext_if)             $TcpState $ext_ifSTO queue (bulk, ack) tagged EGRESS
 pass out log on $ext_if inet proto tcp  from ($ext_if) to !($ext_if) port ssh    $TcpState $ext_ifSTO queue $SshQueue   tagged EGRESS
#pass out log on $ext_if inet proto tcp  from ($ext_if) to !($ext_if) port ftp    $TcpState $FtpSTO    queue (bulk)      tagged EGRESS
 pass out log on $ext_if inet proto udp  from ($ext_if) to !($ext_if)             $UdpState $ext_ifSTO queue (bulk)      tagged EGRESS
 pass out log on $ext_if inet proto udp  from ($ext_if) to !($ext_if) port domain $UdpState $ext_ifSTO queue (dns)       tagged EGRESS
 pass out log on $ext_if inet proto icmp from ($ext_if) to !($ext_if)             $UdpState $ext_ifSTO queue (bulk)      tagged EGRESS