#       $OpenBSD: pf.conf,v 1.31 2006/01/30 12:20:31 camield Exp $

# MACROS AND DEFINITIONS

ext_if="vr0"
int_if="dc0"
localnet = "192.168.0.0/16"

tcp_services = "{ ftp, ssh, domain, http, pop3, imap, auth, pop3s }"
udp_services = "{ domain, ntp }"

Ori = "{ 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8, 169.254.0.0/16, 192.0.2.0/24, 0.0.0.0/8, 240.0.0.0/4 }"
omg_hax = "{ 135, 139, 445 }"
good_icmp = "{ echoreq, unreach }"

scelestus = "192.168.0.187"
lilith = "192.168.0.2"
finalpc = "192.168.0.3"
marianne = "192.168.0.5"

scelestus_ports = "{ ftp, http, https, domain }"
lilith_ports = "{ 10000:19999, auth }"
finalpc_ports = "20000:29999"
marianne_ports = "30000:39999"

table <haxors> persist

# OPTIONS

set block-policy drop

# NORMALIZATION

scrub in all

# QUEUEING

altq on $ext_if cbq bandwidth 100Mb queue { lilith, finalpc, ssh, other, synack }
altq on $int_if cbq bandwidth 100Mb queue { lilith, finalpc, ssh, other, synack }
queue lilith bandwidth 3Mb cbq(borrow red)
queue finalpc bandwidth 3Mb cbq(borrow red)
queue ssh bandwidth 1Mb cbq(borrow red) { ssh_interactive, ssh_bulk }
queue other bandwidth 1Mb cbq(default borrow red)
queue synack bandwidth 1Mb cbq(borrow red) priority 7
queue ssh_interactive bandwidth 256Kb cbq(borrow red) priority 6
queue ssh_bulk bandwidth 256Kb cbq(borrow red) priority 1

# TRANSLATION

nat pass on $ext_if from $localnet to any -> ($ext_if)

rdr on $ext_if proto { tcp, udp } from any to any port $scelestus_ports -> $scelestus
rdr on $ext_if proto { tcp, udp } from any to any port $lilith_ports -> $lilith
rdr on $ext_if proto { tcp, udp } from any to any port $finalpc_ports -> $finalpc
rdr on $ext_if proto { tcp, udp } from any to any port $marianne_ports -> $marianne

# FILTERING

antispoof for ($ext_if)
antispoof for $int_if

#block quick from <haxors>

#block all

block in quick on $ext_if from $Ori to any
block out quick on $ext_if from any to $Ori

block quick proto { tcp, udp } from any to $localnet port $omg_hax

pass log inet proto tcp from any to $localnet port ssh flags S/SA keep state (max-src-conn 15, max-src-conn-rate 5/3, overload <haxors> flush global)

pass out proto tcp to any port $tcp_services keep state
pass quick inet proto { tcp, udp } to any port $udp_services keep state
pass in inet proto tcp from any to any port ssh

pass out on $ext_if inet proto udp from any to any port 33433 >< 33626 keep state

pass inet proto icmp all icmp-type $good_icmp keep state

pass log quick on $int_if proto tcp from any to any port 22 flags S/SA keep state queue (ssh_bulk, ssh_interactive)
pass out quick on $int_if proto { tcp, udp } from any to $lilith port $lilith_ports keep state queue lilith
pass out quick on $int_if proto { tcp, udp } from any to $finalpc port $finalpc_ports keep state queue finalpc

pass log quick on $ext_if proto tcp from any to any port 22 flags S/SA keep state queue (ssh_bulk, ssh_interactive)
pass out quick on $ext_if proto { tcp, udp } from $lilith to any keep state queue lilith
pass out quick on $ext_if proto { tcp, udp } from $finalpc to any keep state queue finalpc
pass out on $ext_if proto tcp from $ext_if to any flags S/SA keep state queue synack
pass in on $ext_if proto tcp from any to $ext_if flags S/SA keep state queue synack