ext_if="fxp0"
int_if="vr0"
hp="{ 192.6.144.0/20, 192.6.160.0/19, 192.6.192.0/18, 15.0.0.0/8 }"

# EXT

## deb     = vnc, www, mysql
## lautaro = mail
## mail    =
## open    = dns, ssh

ip_net1="201.236.83.146" # dns, nat 
ip_net2="201.236.83.147" # ftp, db
ip_net3="201.236.83.148" # mail<OLD
ip_net4="201.236.83.149" # www  
ip_net5="201.236.83.150" # mail, ssh 10022


# INT
ip_obsd="192.168.0.1"
ip_fresia="192.168.0.2"
ip_deb="192.168.0.3"
ip_lautaro="192.168.0.4"

# PORTS
#            gl          ut    gl    svn  my   vnc  pg 
deb_ports="{ 60000:65535 50000 59999 3690 3306 5900 5432 80 22 }"
deb_ports_udp="{ 7777 7778 7787 7788 }"
fresia_ports="{ 21 80 443 60000:65000 }"
obsd_ports="{ 53 22 32256 }"
obsd_ports_udp="{ 53 }"
lautaro_ports="{ 25 110 }"

# TABLAS
table <BUGS> persist file "/etc/pf/BUGS" 
table <LAN> persist file "/etc/pf/LAN" 
table <PROXY> persist file "/etc/pf/PROXY"
table <LANBUG> persist

# SETS
set timeout { interval 10, frag 30 }
set timeout { tcp.first 120, tcp.opening 30, tcp.established 86400 }
set timeout { tcp.closing 900, tcp.finwait 45, tcp.closed 90 }
set timeout { udp.first 60, udp.single 30, udp.multiple 60 }
set timeout { icmp.first 20, icmp.error 10 }
set timeout { other.first 60, other.single 30, other.multiple 60 }
set timeout { adaptive.start 0, adaptive.end 0 }
set limit { states 10000, frags 5000 }
set optimization aggressive
set block-policy drop

set require-order yes

scrub in all
scrub all random-id
scrub all reassemble tcp

# RDR 
rdr on $ext_if proto { tcp,udp } from any to $ip_net1 port 53 -> $ip_obsd

#rdr on $ext_if proto tcp from any to $ip_net2 port 3306        -> $ip_deb
rdr on $ext_if proto tcp from any to $ip_net2 port 5432  -> $ip_deb

rdr on $ext_if proto tcp from any to $ip_net2 port 21   -> $ip_fresia
rdr on $ext_if proto tcp from any to $ip_net2 port 60000:65000 -> $ip_fresia

rdr on $ext_if proto tcp from any to $ip_net3 port 25  -> $ip_lautaro
rdr on $ext_if proto tcp from any to $ip_net5 port 25  -> $ip_lautaro
rdr on $ext_if proto tcp from any to $ip_net3 port 110  -> $ip_lautaro
rdr on $ext_if proto tcp from any to $ip_net5 port 110  -> $ip_lautaro

rdr on $ext_if proto tcp from any to $ip_net4 port 80  -> $ip_fresia

rdr on $ext_if proto tcp from any to $ip_net5 port 10022 -> $ip_obsd port 22
#rdr on $ext_if proto tcp from any to $ip_net5 port 5900 -> $ip_deb
rdr on $ext_if proto tcp from any to $ip_net5 port 3690 -> $ip_deb
rdr on $ext_if proto tcp from any to $ip_net5 port 32256 -> $ip_obsd
rdr on $ext_if proto tcp from any to $ip_net5 port 59999:65535 -> $ip_deb

#squid
# rdr on $int_if inet proto tcp from <PROXY> to any port 80 -> 127.0.0.1 
# port 3128 

# ut
rdr on $ext_if proto tcp from any to $ip_net5 port 50000 -> $ip_deb
rdr on $ext_if proto udp from any to $ip_net5 port $deb_ports_udp -> $ip_deb


#rdr on $ext_if proto tcp from any to $ip_net4 port $lautaro_ports -> $ip_lautaro 
#rdr on $int_if proto tcp from any to 192.168.0.4 -> 192.168.0.3 port 3128
#rdr on $int_if inet proto tcp from 192.168.0.2 to any port 80 -> 192.168.0.3 port 3128

# NAT 
nat on $ext_if from $ip_deb to any -> $ip_net4
nat on $ext_if from $ip_fresia to any -> $ip_net2
nat on $ext_if from $ip_lautaro to any -> $ip_net5
nat on $ext_if from <LAN> to any -> $ip_net1

# antispoof
antispoof for $int_if
antispoof for lo0

# filtros
block in on $ext_if all
block in quick on $ext_if proto tcp from any to any flags /S
block in quick on $ext_if proto tcp from any to any flags /SFRA
block in quick on $ext_if proto tcp from any to any flags /SFRAU
block in quick on $ext_if proto tcp from any to any flags A/A
block in quick on $ext_if proto tcp from any to any flags F/SFRA
block in quick on $ext_if proto tcp from any to any flags U/SFRAU
block in quick on $ext_if proto tcp from any to any flags SF/SF
block in quick on $ext_if proto tcp from any to any flags SF/SFRA
block in quick on $ext_if proto tcp from any to any flags SR/SR
block in quick on $ext_if proto tcp from any to any flags FUP/FUP
block in quick on $ext_if proto tcp from any to any flags FUP/SFRAUPEW
block in quick on $ext_if proto tcp from any to any flags SFRAU/SFRAU
block in quick on $ext_if proto tcp from any to any flags SFRAUP/SFRAUP
block in quick on $ext_if proto tcp all flags FUP/FUP
block in quick on $ext_if proto igmp from any to any
block in log quick on $ext_if from any os NMAP
block in quick on $ext_if from any os unknow

block in log quick on $ext_if proto { tcp, udp } from <BUGS> to any
#testing
block in log quick on $int_if proto { tcp, udp } from any to <BUGS> 

pass out log keep state

pass in log on $ext_if proto icmp from any to any

pass in log on { $int_if, lo0 } all

pass out log on { $int_if, lo0 } all keep state

#block out on $int_if proto tcp from <LAN_NOLET> to any 
#pass out on $int_if proto tcp from <LAN_NOLET> to any port { 80 21 } keep state

pass in log on $ext_if proto tcp from any to $ip_fresia port $fresia_ports flags S/SA keep state
pass in log on $ext_if proto tcp from any to $ip_fresia port 80 flags S/SA synproxy state

pass in log on $ext_if proto tcp from any to $ip_deb port $deb_ports flags S/SA keep state
pass in log on $ext_if proto udp from any to $ip_deb port $deb_ports_udp keep state

pass in log on $ext_if proto tcp from any to $ip_obsd port $obsd_ports flags S/SA keep state
pass in log on $ext_if proto udp from any to $ip_obsd port $obsd_ports_udp modulate state

pass in log on $ext_if proto tcp from any to $ip_lautaro port $lautaro_ports flags S/SA keep state


# Esta bloqueaba el FTP de hp.com
# block in log quick on $int_if proto { tcp, udp } from <PROXY> to any port > 3129 
#block in log quick on $int_if proto { tcp, udp } from <LANBUG> to any

#pass in log quick on $int_if proto { tcp, udp } from <PROXY> to $hp
#block in log on $int_if proto { tcp, udp } from <PROXY> to any port > 3129 


#block in log quick on $int_if proto { tcp, udp } from 192.168.0.2 to any port > 80 
#pass in on $int_if proto tcp from any to 192.168.0.3 port 3128 keep state
#pass in quick log on $ext_if proto tcp from any to any port ssh flags S/SA modulate state \
#(max-src-conn 3, max-src-conn-rate 2/60 overload <bugs> flush global)