# pf.conf

## Macros
EXT="xl0"
INT="fxp0"
INT_IP="192.168.1.104"
WEBSERVER="192.168.1.101"
NET="192.168.1.0/24"
TCP_SERVICES="{ 22, 113, 80 }"
ICMP_TYPES="echoreq"

## Tables

## Global Options
set loginterface $EXT
set block-policy return
set skip on lo
scrub in

## Queueing ruRules

## Translation Rules (NAT(^?)
nat on $EXT from !($EXT) to any -> ($EXT)
rdr on $INT proto tcp from $NET to $EXT port 80 -> \
       127.0.0.1 port 5000

## Filter Rules

# default deny
#block in
pass out keep state
antispoof quick for { lo }

pass in on $EXT inet proto tcp from any to ($EXT) \
        port $TCP_SERVICES flags S/SA keep state

pass in on $EXT inet proto tcp from any to $WEBSERVER port 80 \
        flags S/SA synproxy state

pass in on $INT inet proto tcp from any to $WEBSERVER port 80 \
        flags S/SA synproxy state

pass in inet proto icmp all icmp-type $ICMP_TYPES keep state

pass in quick on $INT