ext_if="rl0"
int_if="xl0"

tcp_services="{ 21, 22, 25, 53, 80, 110, 113, 143, 220, 993, 995 }"
icmp_types="echoreq"

# options
set block-policy drop
set require-order yes
set fingerprints "/etc/pf.os"
set loginterface $ext_if
set limit { states 10000, frags 10000 }

# ignore local loopback
set skip on lo

# scrub
scrub in all

# nat
nat on $ext_if from !($ext_if) to any -> ($ext_if:0)

# Redirection (rdr) for forwarding from external IP to internal IP
rdr pass on $ext_if inet proto {udp tcp} from any to any port 3389 -> 192.168.1.100 port 3389
rdr pass on $ext_if inet proto tcp from any to any port 54321 -> 192.168.1.251 port 22

# Default block rule for passing traffic on all attached interface
block in log all
block out log all

# Pass internal traffic freely
pass on $int_if all

# Pass external traffic with rules
pass out keep state

# Allow TCP/UDP services to the box via port #
pass in on $ext_if inet proto {udp tcp} from any to $ext_if \
   port $tcp_services flags S/SA keep state

# Allow high TCP Ports for FTP
pass in on $ext_if inet proto tcp from any to $ext_if \
   port > 49151 flags S/SA modulate state

# Allow ICMP basic network packets
pass in inet proto icmp all icmp-type $icmp_types keep state

# check for incoming sp00f
antispoof for rl0 inet