#       $OpenBSD: pf.conf,v 1.31 2006/01/30 12:20:31 camield Exp $
#
# See pf.conf(5) and /usr/share/pf for syntax and examples.
# Remember to set net.inet.ip.forwarding=1 and/or net.inet6.ip6.forwarding=1
# in /etc/sysctl.conf if packets are to be forwarded between interfaces.

ext_if="fxp0"
int_net= "{ 172.16.1.0/24, 10.0.0.0/8 }"

table <spamd> persist
table <spamd-white> persist

set loginterface fxp0
set skip on lo
scrub out all
scrub in all

# Redirect all connections from addresses in the <spamd> table
# to port 8025.
# NB: $ext_if=interface ($ext_if)=address associated w/ interface.
#rdr on $ext_if inet proto tcp from <spamd> to ($ext_if) port smtp \
rdr on $ext_if inet proto tcp from <spamd> to $ext_if port smtp \
         -> 127.0.0.1 port spamd
#rdr on $ext_if inet proto tcp from !<spamd-white> to ($ext_if) port smtp \
rdr on $ext_if inet proto tcp from !<spamd-white> to $ext_if port smtp \
        -> 127.0.0.1 port spamd

block in all

pass quick from $int_net
antispoof quick for lo

# Allow previously blocked packets to pass for
# redirection.
pass in log on lo0 inet proto tcp \
 to 127.0.0.1 port spamd

pass in on $ext_if proto tcp to ($ext_if) port ssh keep state
pass out on $ext_if proto tcp to ($ext_if) port ssh keep state

# needed??! why can't mail get out?!
pass out on $ext_if proto tcp to any port smtp