# set some variables
ext_if="fxp0"
int_if="fxp1"
state_if="fxp2"
mgmt_if="fxp3"

#### Firewall Networks
spamd   = "192.168.1.36"
unigold_175 = "103.88.46.175/32"
unigold_176 = "103.88.46.176/32"

##OPTIONS##
###### OPTIONS #####
## timeouts
set timeout tcp.first                   120
set timeout tcp.opening                 30
set timeout tcp.established             86400
set timeout tcp.closing                 900
set timeout tcp.finwait                 45
set timeout tcp.closed                  90
set timeout udp.first                   60
set timeout udp.single                  30
set timeout udp.multiple                60
set timeout icmp.first                  20
set timeout icmp.error                  10
set timeout other.first                 60
set timeout other.single                30
set timeout other.multiple              60
set timeout frag                        30
set timeout interval                    10
set timeout adaptive.start              0
set timeout adaptive.end                0
set timeout src.track                   0
set timeout interval                    5
set timeout frag                        20
set limit { states 50000, frags 50000 }

set block-policy drop
set optimization normal
set state-policy if-bound
set require-order yes

scrub in all no-df random-id
scrub out all no-df random-id max-mss 1460

#scrub in all

## Spamd Stuff
# Table that spamd updates

# grey host list
table <spamd> persist
# white host lists
table <spamd-white> persist
# This whitelist we are manually maintaining.
table <whitelist> persist file "/etc/whitelist.txt"


rdr on $ext_if proto tcp from !<whitelist>  to any port smtp -> 127.0.0.1 port 8025
pass in on $ext_if route-to lo0 proto tcp from any to 127.0.0.1 port 8025


#-----------------------------#
#------ Anti-spoofing --------#
#

#antispoof for lo0

#block by default
block in log all

#block in quick on the following request.
block in log quick proto tcp flags FUP/WEUAPRSF
block in log quick proto tcp flags WEUAPRSF/WEUAPRSF
block in log quick proto tcp flags SRAFU/WEUAPRSF
block in log quick proto tcp flags /WEUAPRSF
block in log quick proto tcp flags SR/SR
block in log quick proto tcp flags SF/SF
block in log quick proto tcp from {$bad_ip} to any

#ignore everything on these interfaces
pass quick on pfsync0 proto pfsync
pass quick on $state_if proto pfsync
pass quick on $int_if all modulate state
pass quick on $mgmt_if all modulate state

### LOOPBACK

pass in quick on lo0 all
pass out quick on lo0 all

# out on ext_if
pass out on $ext_if proto { tcp, udp, icmp } all modulate state

# out on state_if
pass out on $state_if proto { tcp, udp, icmp } all modulate state


### Unigold SSH configuration
# Allowed incoming tcp service (ssh)

pass in on $ext_if proto tcp from any to $unigold_175 port \
        { 22 } \
        flags S/SA keep state

pass in on $ext_if proto tcp from any to $unigold_176 port \
        { 22, 8443, 45665 } \
        flags S/SA keep state