# PF configuration for Central de Vendas Informatica LTDA.

# macros
ext_if = ""
int_if = ""

int_tomcat = "192.168.1.134"
ext_tomcat = "201.12.35.52"

priv_nets = "{ 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 }"

tcp_services = "{ 20, 21, 80, 443, 1723 }"
icmp_types = "echoreq"

# options
set block-policy return
set loginterface $ext_if

# scrub
scrub in all fragment reassemble

# nat
nat on $ext_if from $int_if:network to any -> ($ext_if)
rdr on $int_if proto tcp from any to any port 21 -> 127.0.0.1 \
        port 8021

# filter
block all
        
pass quick on lo0 all

block drop in  quick on $ext_if from $priv_nets to any
block drop out quick on $ext_if from any to $priv_nets

block drop quick proto tcp from any to any port 1863

pass in inet proto icmp all icmp-type $icmp_types keep state

pass in on $ext_if inet proto tcp from any to ($ext_if) \
        port $tcp_services flags S/SA keep state
        
pass out on $ext_if proto tcp all modulate state flags S/SA
pass out on $ext_if proto { udp, icmp } all keep state