# pf.conf - Packet Filter configuration file
# Rules must be in order: macros, tables, options, normalization, queueing, translation, filtering
# Version: 0.5
# Created: 12.2.2009 by Dzodzo
# Modified: 7.10.2010 by Dzodzo (kirril is behind router now)


####################
# macro definition #
####################
ext_if="re0"
ftp_ports="{ 20, 6601, 6602, 6609, 6670 >< 6699 }"
allowed_ports="{ 80, 113, 6667, 6602 >< 6661, 27000 >< 29900 }"


####################
# table definition #
####################
# create table for SSH bruteforce scriptkiddies
table <bruteforce> persist file "/etc/pf.bruteforce"
#table <bruteforce> persist
#table <nonroutable_ip> const { 127.0.0.1, 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8 }
table <ftpspammers> persist file "/etc/pf.ftpspammers"


###########
# options #
###########
# don't filter on the loopback interface
set skip on lo0
set loginterface $ext_if


#################
# normalization #
#################
scrub in


##########
# queues #
##########
# root queue
altq on $ext_if cbq bandwidth 20Mb queue { ssh scp ftp other p2p }

queue other bandwidth 8Mb priority 4 cbq(default)
queue ssh bandwidth 2Mb priority 5 cbq(red)
queue scp bandwidth 2Mb priority 3 cbq(borrow red)
queue ftp bandwidth 4Mb priority 2 cbq(borrow red)
queue p2p bandwidth 4Mb priority 1 cbq(borrow red)


#################
# NAT/RDR rules #
#################
# interface enclosed in ( ) brackets will have its IP address updated by PF in case it changes (DHCP)
no nat on $ext_if

# redirect for uTorrent running on virtual pc
#rdr pass on $ext_if proto { tcp udp } to port 36004 -> 10.0.0.3

##########################
# packet filtering rules #
##########################
# $ext_if inbound traffic
block in quick on $ext_if from <ftpspammers> to any

pass in log on $ext_if label "overall-inbound"
pass in on $ext_if proto { tcp udp } from any to any port ssh queue ssh
pass in on $ext_if proto { tcp udp } from any to any port 8022 queue scp
pass in quick on $ext_if proto { tcp udp } from any to any port $ftp_ports queue ftp
pass in on $ext_if proto { tcp udp } from any to any port { 2706 51413 } queue p2p
pass in on $ext_if proto tcp from any to any port 25 queue other
pass in on $ext_if proto { tcp udp } from any to any port $allowed_ports queue other

# this should block anyone who tries to make more than 5 ssh connection in 30 seconds or more than 10 simultaneous total connections
pass in log on $ext_if proto tcp from any to $ext_if port ssh flags S/SA keep state (max-src-conn 10, max-src-conn-rate 5/30, overload <bruteforce>) queue ssh
block in on $ext_if from <bruteforce> to any
pass in on $ext_if from 193.179.62.1 to any queue ssh

# $ext_if outbound traffic
block out on $ext_if from any to any
block out quick on $ext_if from any to <nonroutable_ip>

pass out log on $ext_if label "overall-outbound"
pass out quick on $ext_if proto { tcp udp } from any to any port ssh queue ssh
pass out quick on $ext_if proto { tcp udp } from any to any port 8022 queue scp
pass out quick on $ext_if proto { tcp udp } from ($ext_if) to any port $ftp_ports queue ftp
pass out on $ext_if proto { tcp udp } from ($ext_if) port { 2706 51413 } to any queue p2p
pass out on $ext_if proto { tcp udp } from ($ext_if) to any port $allowed_ports queue other