# macros
int_if = "bge0"
ext_if = "bge1"
dmz_if = "em0"
ALL_if="{" $ext_if $int_if $dmz_if "}"

webserver = "192.168.3.2"
IVR = "192.168.3.3"
mailserver = "192.168.0.8"
dmz_net = "{" $webserver $IVR "}"
int_net = "192.168.0.0/8"
ext_net = "204.101.222.131/32"

#redirect rules
rdr pass on $dmz_if proto tcp from $webserver to $dmz_if port 25 -> $mailserver
rdr pass on $int_if proto tcp from any to any port 80 -> $webserver port 80

#default block filter
block all

#trust everything on the internal interface
pass quick on $int_if all

#all loopback (localhost) is permitted
pass quick on lo0 all

#block 192.168.3.x
block drop in quick on $int_if from $int_net to $dmz_net

#permit access to webserver on DMZ
pass out on $dmz_if proto tcp from any to $webserver port 80 \
   flags S/SA keep state
pass out on $dmz_if proto tcp from any to $webserver port 443 \
   flags S/SA keep state

# permit RDP access to servers on the DMZ
pass out on $dmz_if proto tcp from $int_net to $dmz_net port 3389 keep state

#Finally, pass traffic out on the external interface:
#TCP, UDP, and ICMP traffic is permitted to exit the firewall towards the
#Internet. State information is kept so that the returning packets will be
#passed in through the firewall.

#pass out on $ext_if proto tcp all modulate state flags S/SA
#pass out on $ext_if proto { udp, icmp } all keep state
#antispoof for $ext_if inet

# permit HTTP/HTTPS and SSH on External interface
#pass in on $ext_if proto tcp from any to $ext_net port {80 443 22} \
#   flags S/SA keep state