# PF configuration for Central de Vendas Informatica LTDA.
# admin@centralinf.com.br

### macros ###
central_ext = "xl1"
central_ext_ip = "201.12.35.xx1"
central_int = "xl0"
central_int_net = "192.168.1.0/24"
central_ipsec = "201.12.35.xx3"

odin_int = "192.168.1.134"
odin_ext = "201.12.35.xx2"

saint_int = "192.168.1.53"
saint_ext = "201.12.35.54"
saint_net= "200.230.207.0/24"

sicredi_ext_ip = "201.77.95.20"
sicredi_net = "172.16.0.0/12"

### tables ###
table <ti> { 192.168.1.120, 192.168.1.121, 192.168.1.122, \
	192.168.1.123, 192.168.1.124 }
table <orkut> { 72.14.209.85, 72.14.209.86, 72.14.209.87 }

### options ###
set loginterface $central_ext
set skip on lo

### scrub ###
scrub all no-df fragment reassemble random-id

### nat ###

# nat for all network.
nat on $central_ext from $central_int:network to any -> $central_ext:0
nat-anchor "ftp-proxy/*"

# binat for odin.
binat on $central_ext from $odin_int to any -> $odin_ext

# binat for saint.
binat on $central_ext from $saint_int to $saint_net -> $saint_ext

### redirects ###

# ftp-proxy.
rdr-anchor "ftp-proxy/*"
rdr pass on $central_int proto tcp to port ftp -> 127.0.0.1 port 8021

# transparent proxy.
rdr on $central_int proto tcp from any to any port http -> 127.0.0.1 port 3128

### filter rules ###

# block everything.
block log all

# antispoof and ftp-proxy anchor.
antispoof for $central_int inet
anchor "ftp-proxy/*"

# allow vpn (ipsec) from central to sicredi.
pass in proto esp from $sicredi_ext_ip to $central_ipsec
pass out proto esp from $central_ipsec to $sicredi_ext_ip

pass in on enc0 proto ipencap from $sicredi_ext_ip to $central_ipsec
pass in on enc0 from $sicredi_net to $central_int_net
pass out on enc0 from $central_int_net to $sicredi_net

pass in on $central_ext proto udp from $sicredi_ext_ip port = 500 to \
	$central_ipsec port = 500
pass out on $central_ext proto udp from $central_ipsec port = 500 to \
	$sicredi_ext_ip port = 500

# allow all traffic on $central_int.
pass on $central_int

# allow all traffic on tun (for pptp).
pass quick on tun

# allow orkut to <ti>.
pass in quick on $central_int inet proto tcp from <ti> to <orkut> \
	port { http, https } modulate state flags S/SA

# block orkut.
block in quick on $central_int inet proto tcp from any to <orkut> \
	port { http, https }

# allow msn to <ti>.
pass in quick on $central_int inet proto tcp from <ti> to any \
	port 1863 modulate state flags S/SA

# block msn.
block in quick on $central_int inet proto tcp from any to any port 1863

# allow ping.
pass in quick inet proto icmp all icmp-type echoreq keep state

# allow vpn (pptp) 
pass in quick on $central_ext inet proto tcp from any to $central_ext_ip \
	port pptp modulate state flags S/SA
pass in quick on $central_ext inet proto gre from any to $central_ext_ip \
	keep state

# allow dns.
pass in quick on $central_ext inet proto udp from any to $central_ext_ip \
	port domain keep state

# allow ftp and http to odin.
pass in quick on $central_ext inet proto tcp from any to $odin_int \
	port { ftp, ftp-data, http, > 49151 } modulate state flags S/SA

# allow all tcp, udp and icmp pass out.
pass out quick on $central_ext inet proto { tcp, udp, icmp } all \
	modulate state flags S/SA