#
# $Id: pf.conf.35,v 1.1 2004/08/23 17:38:48 raptor Exp $
#
# pf.conf.35 - Sample OpenBSD 3.5 PF/NAT ruleset
# Copyright (c) 2004 Marco Ivaldi <raptor@0xdeadbeef.info>
#
# The pf(4) packet filter modifies, drops or passes packets according to
# rules or definitions specified in pf.conf(5). This is a sample basic
# ruleset for the configuration of an OpenBSD 3.5 stateful packet filter.
#
# Tested on OpenBSD 3.5 with 2 NICs, change it to fit your configuration.
#

###############################################################################
# Macros
#
# User-defined variables may be defined and used later, simplifying the
# configuration file. Macros must be defined before they are referenced.
#

# available interfaces
ext_if=         "fxp0"
int_if=         "fxp1"

# list of networks
ext_net=        "10.65.6.0/24"
int_net=        "192.168.0.0/24"

# list of hosts
fw_ext=         "10.65.6.1"

###############################################################################
# Tables
#
# Tables provide a mechanism for increasing the performance and flexibility
# of rules with large numbers of source or destination addresses.
#

table   <private> { 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 }
table   <trusted> { 10.65.6.0/24, 10.65.6.2 }

###############################################################################
# Options
#
# Options tune the behaviour of the packet filtering engine.
#

set     optimization normal
set     block-policy return

###############################################################################
# Traffic Normalization
#
# Traffic normalization protects internal machines against in Internet
# protocols and implementations.
#

scrub   in all
#scrub  out all

###############################################################################
# Translation
#
# Translation rules specify how addresses are to be mapped or redirected to
# other addresses.
#

nat     on $ext_if inet from $int_net to any -> ($ext_if)
rdr     on $int_if inet proto tcp from any to any port 21 -> 127.0.0.1 port 8021

###############################################################################
# Packet Filtering
#
# Stateful and stateless packet filtering provides rule-based blocking or
# passing of packets.
#

# default policy
block   in log all
block   out all

# trusted interfaces
pass    in quick on lo0 all
pass    out quick on lo0 all
pass    in quick on $int_if all
pass    out quick on $int_if all

# egress filtering
block   out quick on $ext_if inet from !$ext_net to any

# anti-spoofing
block   drop in quick on $ext_if inet from <private> to any

# outbound traffic (icmp, udp, tcp)
pass    out on $ext_if inet proto { icmp, udp, tcp } all keep state

# inbound traffic
pass    in on $ext_if inet proto tcp from any to $fw_ext user proxy keep state
pass    in on $ext_if inet proto tcp from <trusted> to $fw_ext \
        port 22 flags S/SA keep state