#       $OpenBSD: pf.conf,v 1.29 2005/08/23 02:52:58 henning Exp $
#
# See pf.conf(5) and /usr/share/pf for syntax and examples.
# Remember to set net.inet.ip.forwarding=1 and/or net.inet6.ip6.forwarding=1
# in /etc/sysctl.conf if packets are to be forwarded between interfaces.

#macros
if_ppp="tun0"
if_int="fxp0"
if_vpn="tun1"
ip_marvin="195.56.55.204"
ip_zaphod="192.168.2.1"

tcp_outdeny="{25}"

#tables
table <localnets> persist { 10.1.0.0/16, 10.2.0.0/16, 10.3.0.0/16, 127.0.0.1/8, 192.168.2.1/32 }
table <natnets> persist { 10.1.0.0/16, 10.3.0.0/16, 192.168.2.1/32 }

#options
set block-policy return
set debug none
set limit frags 4096
set state-policy floating

# scurb
scrub in on $if_ppp all fragment reassemble
scrub in on $if_int all no-df
scrub on $if_ppp all random-id

# queueing. fuck skype
# priority: 1) ssh 2) web 3) other
#altq on $if_ppp cbq bandwidth 176Kb queue { std, ssh, http, ack }
#queue std bandwidth 10% priority 0 cbq(default)
#queue ack bandwidth 5% priority 7 cbq(borrow)
#queue ssh bandwidth 55% priority 6 cbq(borrow)

altq on $if_ppp hfsc bandwidth 170Kb queue { std, ssh, http, ack, vpn, stdack}
queue std bandwidth 16% priority 0 hfsc (default realtime 32Kb upperlimit 170Kb)
queue ssh bandwidth 16% priority 5 hfsc (realtime 32Kb upperlimit 160Kb )
queue http bandwidth 16% priority 2 hfsc (realtime 16Kb upperlimit 160Kb )
queue stdack bandwidth 16% priority 5 hfsc ( realtime 8Kb upperlimit 160Kb)
queue vpn bandwidth 16% priority 6 hfsc ( realtime 16Kb upperlimit 170Kb)
queue ack bandwidth 16% priority 7 hfsc ( realtime 8Kb upperlimit 160Kb)

# NAT
nat on $if_ppp from {10.1.0.0/16, 127.0.0.1, $ip_zaphod} to 0.0.0.0/0 -> ($if_ppp:0)

# redirected taffic
rdr on $if_int proto tcp from any to any port 21 -> 127.0.0.1 port 8021
rdr on $if_ppp inet proto {tcp,udp} to port 60050 -> 10.1.0.1 port 60050
rdr on $if_ppp inet proto {tcp,udp} to port 60150 -> 10.1.0.1 port 60150
rdr pass on {$if_int, $if_vpn, lo0 } inet proto tcp from any to 10.1.0.254 port 80 -> $ip_zaphod port 80
#rdr on $if_ppp inet proto udp to port 6881 -> 10.1.0.1 port 6881
rdr pass on $if_ppp proto tcp to port 8010 -> 10.1.0.1 port 8010

# filtering
block in log on $if_ppp all

#localhost communication
pass in quick on lo0
pass out quick on lo0

pass out on $if_ppp from any to any queue (std, stdack)

# enable VPN
pass in quick on $if_ppp proto udp from $ip_marvin port 5000
pass out quick on $if_ppp proto udp to $ip_marvin port 5000 keep state queue (vpn)

#
pass out quick on $if_ppp proto tcp from any to port 22 flags S/SA keep state queue (ssh, ack)
pass out quick on $if_ppp proto tcp from any to port {80,443} flags S/SA keep state queue (http, ack)

# allow outgoing TCP,UDP,ICMP,IGMP traffic
pass out quick on $if_ppp flags S/SA keep state
pass out quick on $if_ppp proto udp keep state
pass out quick on $if_ppp proto {icmp,igmp} keep state

# enable ftp-prxoy
pass in quick on $if_ppp inet proto tcp from any to ($if_ppp:0) user proxy keep state

# enable torrent
#pass in quick on $if_ppp proto tcp to port 50100:51000 keep state
pass in quick on $if_ppp proto {udp,tcp} to port 60050
pass in quick on $if_ppp proto {udp,tcp} to port 60150
pass out quick on $if_ppp proto tcp from port 60150 to any keep state queue(std, stdack)
#pass in quick on $if_ppp proto udp to port 6881 keep state

# disable denied outgoing connections
block out quick on $if_ppp proto tcp from <localnets> port $tcp_outdeny to any