# Packet filter ruleset
#
# =================================================================================
# macros
# =================================================================================

int_if = "tl0"
ext_if = "xl0"
wi_if  = "ral0"

nat_ip = "82.69.182.61"
irc_ip = "82.69.182.60"
mail_ip = "82.69.182.59"

tcp_services = "{ 22, 113 }"
icmp_types = "echoreq"

allowed_out_tcp = "{ 20, 21, 25, 53, 80, 110, 443, 1863, 5190, 6665,6666,6667,6668 }"
allowed_out_udp = "{ 53 }"

priv_nets = "{ 192.168.123.0/24, 192.168.122.0/24, 127.0.0.0/8 }"

trusted_services = "{ some numbers in here }"
trusted_hosts = "secret"

table <blacklist> persist file "/etc/pf.blacklist"

# =================================================================================
# options
# =================================================================================

#set block-policy return
#set loginterface $ext_if

# scrub
scrub in all

# =================================================================================
# nat/rdr
# =================================================================================

nat on $ext_if from $int_if:network to any -> ($ext_if)
binat on $ext_if from 192.168.123.10 to any -> 82.69.182.60
binat on $ext_if from 192.168.123.11 to any -> 82.69.182.59


# Trusted services

rdr on $ext_if proto tcp from $trusted_hosts to any port $trusted_services -> 192.168.123.50

# =================================================================================
# filter rules
# =================================================================================


# Default rules
# ******************************************
# lo0 is a trusted interface (loopback)
# by default, block all incomming and outgoing traffic
# Also immediately block any blacklisted IP

pass quick on lo0 all
block in on $ext_if all
block in quick on $ext_if from <blacklist> to any
block out log on $ext_if all

block drop in quick on $ext_if from $priv_nets to any
block drop out quick on $ext_if from any to $priv_nets



# ************************************************
pass in log quick on $int_if proto tcp from $priv_nets to any port 22
pass in log quick on $ext_if proto tcp from $trusted_hosts to any port $trusted_services


# General network connectivity and natting
# ******************************************

pass in inet proto icmp all icmp-type $icmp_types keep state
pass in  quick on $int_if from $int_if:network to any keep state
pass out quick on $int_if from any to $int_if:network keep state


pass out quick on $ext_if proto tcp from any to any port $allowed_out_tcp modulate state flags S/SA
pass out quick on $ext_if proto icmp all keep state
# pass out quick on $ext_if proto udp from any to any port $allowed_out_udp
pass out quick on $ext_if proto udp from any to any port $allowed_out_udp keep state

# pass out quick on $ext_if proto { udp, icmp } all keep state



# End of config
# .