#       $OpenBSD: pf.conf, v1.9 2007/02/18 17:36:08 Stillman
# Order - MACROS, TABLES, OPTIONS, SCRUB, QUEUEING, TRANSLATION, FILTER RULES
#
# See pf.old, pf.conf(5), and /usr/share/pf for syntax and examples.
# Remember to set net.inet.ip.forwarding=1 and/or net.inet6.ip6.forwarding=1
# in /etc/sysctl.conf if packets are to be forwardes between interfaces.


# MACROS
        # INTERFACES
ext_if = "hme0" # Macro for external interface
int_if = "hme1" # Macro for internal interface

                # ext_if IP address could be dynamic, hence ($ext_if)

        # SERVICES
tcp_services = "{ www, https, ftp-data, ftp, ssh, domain, pop3, pop3s, \
                  smtp, auth, nntp, cvspserver, 446, 1863, 2628, 8000, \
                  8080, 6881:6999 }"
udp_services = "{ domain, ntp }"
udp_voip = "{ 5060:5061, 16384:16482 }"
icmp_types = "echoreq"


# TABLES
        # SCANNERS TABLE - FOR ATTACKING SCANNERS/PROBES
table <scanners> persist

# OPTIONS
        # REQUIRE ORDER
set require-order yes

        # PACKET FEEDBACK
set block-policy drop

        # STATISTICS LOGGING ON
set loginterface $ext_if

        # OPTIMIZATION LEVEL
set optimization normal

        # SKIP PF
set skip on lo0

        # PF STATE KEEPING BEHAVIOR
set state-policy floating


# SCRUB
scrub in on hme1 all no-df
scrub    on hme1 all reassemble tcp


# QUEUEING
#altq on $ext_if hfsc bandwidth 500Kb queue { phone_q, main_q }
#queue phone_q  bandwidth 64Kb  priority 7  hfsc(realtime 64Kb)
#queue main_q   bandwidth 436Kb priority 1  hfsc(default)


# TRANSLATION
        # NAT
nat on $ext_if from $int_if:network to any -> ($ext_if)

        # FTP REDIRECTION
rdr on $int_if proto tcp from any to any port ftp -> 127.0.0.1 \
        port 8021


# FILTER RULES
#block all
block in quick log on $ext_if proto tcp from <scanners> to $ext_if port ssh

# Defaults to allow specified traffic to pass
pass out inet proto tcp from $int_if:network to any port $tcp_services \
        flags S/SA keep state
pass proto udp from $int_if:network to any port $udp_services keep state

# Allow VOIP phone registration and data
pass proto udp from $int_if:network to any port $udp_voip

# FTP Pass - RDR
pass in on $ext_if inet proto tcp from port ftp-data to ($ext_if) \
        keep state (max-src-conn-rate 3/60, overload <scanners> flush \
        global)

pass in on $ext_if inet proto tcp from any to #ext_if port ssh

pass quick inet proto { tcp, udp } to any port $udp_services keep state

# Allows queue to be assigned to passing traffic
#pass out on $ext_if inet proto tcp from $ext_if to any flags S/SA \
        keep state queue (main_q, phone_q)
#pass in  on $ext_if inet proto tcp from any to $ext_if flags S/SA \
        keep state queue (main_q, phone_q)

        # ALLOW PING
pass inet proto icmp all icmp-type $icmp_types keep state

        # ALLOW TRACEROUTE
                # Allow out the default range for traceroute(8):
                # "base+nhops*nqueries-1" (33434+64*3-1)
pass out on #ext_if inet proto udp from any to any \
        port 33433 >< 33626 keep state


        # ANTISPOOFING
antispoof for { $ext_if }