#	$OpenBSD: pf.conf,v 1.31 2006/01/30 12:20:31 camield Exp $
#
# See pf.conf(5) and /usr/share/pf for syntax and examples.
# Remember to set net.inet.ip.forwarding=1 and/or net.inet6.ip6.forwarding=1
# in /etc/sysctl.conf if packets are to be forwarded between interfaces.

ext_if="rl0"
int_if="xl0"

tcp_services="{ 21, 22, 25, 53, 80, 110, 113, 143, 220, 993, 995 }"
icmp_types="echoreq"

# options
set block-policy drop
set require-order yes
set fingerprints "/etc/pf.os"
set loginterface $ext_if
set limit { states 10000, frags 10000 }

# ignore local loopback
set skip on lo

# scrub
scrub in all

# nat
nat on $ext_if from 192.168.1.0/24 to any -> 208.177.233.66

# Redirection (rdr) for forwarding from external IP to internal IP
rdr on $ext_if inet proto tcp from any to any port 3390 -> 192.168.1.100
rdr on $ext_if inet proto tcp from any to any port 3389 -> 192.168.1.250
rdr on $ext_if inet proto tcp from any to any port 54321 -> 192.168.1.251 port 22

# Allow traffic on all attached interfaces
pass in all
pass out all

# Default block rule for passing traffic on all attached interface
block in log all
block out log all

# Pass internal traffic freely
pass in quick on $int_if all
pass out quick on $int_if all

# Pass external traffic with rules
pass out keep state

# Allow TCP/UDP services to the box via port #
pass in on $ext_if inet proto {udp tcp} from any to $ext_if \
   port $tcp_services flags S/SA keep state

# Allow high TCP Ports for FTP
pass in on $ext_if inet proto tcp from any to $ext_if \
   port > 49151 flags S/SA modulate state

# Allow ICMP basic network packets
pass in inet proto icmp all icmp-type $icmp_types keep state