###############################################################
#  PF FIREWALL BY KiOrKY
##############################################################
### macros - here's where you set variables for use in your rules
####INTERFACES DECLARATION
loop="lo0"
ext_if="rl0"
int_if="rl1"
ifs="rl"
####HOSTS DEFINITION
#ip_locales="{192.168.0.2,192.168.0.3,$birdy,192.168.0.7,$khalia}"
addrtunnelipv6="213.121.24.85"
alderia="192.168.0.xx"
khalia="192.168.0.x"
conshita="192.168.0.x"
sakura="192.168.0.x"
birdy="192.168.0.x"
lutsianna="192.168.0.x"
shapai="192.168.0.x"
lut_win="192.168.0.x"
adr_p2p=$birdy
adr_bt=$birdy
local_net=$shapai
table <ip_locales>  persist {$lut_win,$lutsianna,$alderia,$khalia,$conshita,$sakura,$birdy,$shapai}
# rejets
ports_blocked="{1227,2967,1025:1027,445,ms-sql-m,loc-srv,netbios-ssn,3306,5800,ms-sql-s,netbios-ns}"
dams="62.160.32.43,www.dams.net,83.141.79.88"
table <ever> persist {192.168.0.155,193.201.80.25,193.201.80.251,$dams}
table <temp>  persist {192.168.0.155}
table <abusive_hosts>  persist
#####################
# POOLS d'IP
# irc
freenode="bandit.probe-networks.de"
freenode1="niven.freenode.osuosl.org"
toto="kornbluth.freenode.net,zelazny.freenode.net"
quakenet="bandit.probe-networks.de,82.211.16.16"
quakenet2="82.211.16.17"
ircnet="ircnet.nerim.fr"
table <irc_auth>  persist {$freenode1,$freenode,$ircnet,$quakenet,$quakenet2}
# nntp
nntp_servers1="news.free.fr"
table <nntp_servers>  persist {$nntp_servers1}
######################################################################################
####PLAGES DEFINITIONS
unfiltered="{ lo0, rl1 }"
# limit
limit_part=""
#unfiltered="{ lo0}"
#####ports macros
# reste
age_of_empires2_ports="'2299:2400 6073 7100:7200'"
alderia_ssh_port="'https'"
birdy_ssh_port="'667'"
bt_ports="'12000:13999'"
conshita_ftpd="'555'"
conshita_ftpdpsv="'4051:4251'"
conshita_ssh_port="'669'"
dcc_ports="'4300:4400'"
dns_ntp_q_ports="{domain ntp}"
freeplayer_dest="'freeplayer.freebox.fr'"
freeplayer_host=$lutsianna
freeplayer_port="'1234'"
freeplayer_stream_port="'8080'"
half_life_ports="'27005 27015:28500'"
hq_ports="{22 443 666 667 668 669 670 671}"
irc_ports="'6666:7000'"
khalia_ftpd="'556'"
khalia_ftpdpsv="'4252:4350'"
khalia_ssh_port="'666'"
lutsianna_ssh_port="'671'"
p2p_ports="'10000:11999'"
radio_ports="'8000:8001'"
shapai_ssh_port="'670'"
teamspeak_port="'8767'"
tetrinet_port="'31457'"
webhq_q_ports="{smtp 119}"
worms_world_party_ports="'17010:17012 9999 5500:5510'"
birdy_core_svcs="'ftp auth'"
#####services
alderia_svcs="{ ssh}"
birdy_svcs="{" $birdy_core_svcs $teamspeak_port $dcc_ports $bt_ports $p2p_ports "}"
conshita_svcs="{ smtp http }"
khalia_svcs="{" $tetrinet_port $khalia_ssh_port $khalia_ftpdpsv $khalia_ftpd $radio_ports "}"
lutsianna_svcs="{" $lutsianna_ssh_port $half_life_ports "}"
shapai_lsvcs="{ ssh domain imap }"
shapai_svcs="{ domain }"
#####redirections
ssh_redirs="{666 667 668 669 670 443 671}"
aprot="{tcp udp}"
aprot6="{tcp udp icmp}"
########################################################################################
########################################################################################
## OPTIONS - network settings
set block-policy drop
set loginterface $ext_if
#######################################################################################
#######################################################################################
## NORMALIZATION - Scrubbing will automatically drop TCP packets that have invalid
# flag combinations, so there's no need for typical 'anti-portscan' rules that ipf
# and ipfw use.
scrub in on $ext_if
scrub out on $ext_if no-df random-id min-ttl 24 max-mss 1500
########################################################################################
#######################################################################################
## ALTQ / QoS
# altq on interface scheduler bandwidth bw qlimit qlim tbrsize size #queue { #queue_list }
# #queue name [on interface] bandwidth bw [priority pri] [qlimit qlim] scheduler ( sched_options ) { #queue_list }
# enable #queueing on the external interface to control traffic going to the Internet.
#altq on $ext_if        cbq bandwidth 1000Mb #queue {freeplayer,net}
#queue freeplayer bandwidth 999Mb  priority 1 cbq (red,ecn)
#queue net bandwidth 736Kb    priority 2 cbq { dl_out,web_out,webhq_out,h_p_out,hb_out}
        #queue  hb_out          bandwidth  406Kb  priority 1    cbq  ( borrow )  {p2p_out,httpd_out,radio_out}
                #queue  p2p_out         bandwidth 5%    priority 1      cbq     ( borrow )
                #queue  httpd_out       bandwidth 75%   priority 3      cbq     ( borrow )
                #queue  radio_out       bandwidth 20%   priority 5      cbq     ( borrow red )
        #queue  web_out         bandwidth 170Kb priority 3      cbq     ( default red )
        #queue  h_p_out         bandwidth 150Kb priority 6      cbq     ( borrow red ) { ipv6, h_p_out_m }
                #queue  ipv6            bandwidth 30%   priority 3      cbq
                #queue  h_p_out_m       bandwidth 70%   priority 3      cbq     ( borrow )

#######################################################################################
#######################################################################################
## TRANSLATIONS - nat, binat and rdr pass rules
#nat [pass] on interface [af] from src_addr [port src_port] to \
#   dst_addr [port dst_port] -> ext_addr [pool_type] [static-port]
#no nat on $unfiltered
#no rdr pass on $unfiltered
#ftp proxy
#nat-anchor "ftp-proxy/*"
#rdr pass-anchor "ftp-proxy/*"
nat on $ext_if inet from <ip_locales>  to any -> $ext_if
# alderia
rdr pass on $ext_if inet proto $aprot from any to any port $alderia_svcs       -> $alderia
# birdy
rdr pass on $ext_if inet proto $aprot from any to any port $birdy_svcs         -> $birdy
# conshita
rdr pass on $ext_if inet proto $aprot from any to any port $conshita_svcs      -> $conshita
# khalia
rdr pass on $ext_if inet proto $aprot from any to any port $khalia_svcs        -> $khalia
# lutsianna
rdr pass on $ext_if inet proto $aprot from any to any port $lutsianna_svcs     -> $lutsianna
# shapai
rdr pass on $ext_if inet proto $aprot from any to any port $shapai_svcs        -> $shapai
# ssh
rdr pass on $ext_if inet proto $aprot from any to any port $khalia_ssh_port    -> $khalia    port 22
rdr pass on $ext_if inet proto $aprot from any to any port $birdy_ssh_port     -> $birdy     port 22
rdr pass on $ext_if inet proto $aprot from any to any port $conshita_ssh_port  -> $conshita  port 22
rdr pass on $ext_if inet proto $aprot from any to any port $alderia_ssh_port   -> $alderia   port 22
rdr pass on $ext_if inet proto $aprot from any to any port $lutsianna_ssh_port -> $lutsianna port 22
rdr pass on $ext_if inet proto $aprot from any to any port $shapai_ssh_port    -> lo0        port 22
# ipv6/ipv4
rdr pass on $ext_if inet proto $aprot from $addrtunnelipv6 to any  -> $alderia
#######################################################################################
#######################################################################################
# FILTER - specific rules for blocking and allowing various traffic
#DNS
pass quick proto $aprot  to any port 53 keep state
pass quick proto $aprot  from any port 53 keep state
########################
# BLOQUER LES CHIEURS
#######################
#pass quick all
block quick proto $aprot from any port $ports_blocked
block quick proto $aprot   to any port $ports_blocked
block quick     from <ever>
block quick     to   <ever>
block quick log     from <abusive_hosts>
block quick log     to   <abusive_hosts>
####################################
#autoriser les ip forwardees
# AUTORISATION POUR CES REDIRECTIONS
####################################
# Deny and log all by default  This replaces 'block in all' and 'block out all'
#dont log pfsync trames for logs size
block quick proto pfsync
block log
pass quick on $unfiltered keep state
# default
# autoriser les machines en sortie
#pass quick proto $aprot  to  192.168.0.11 keep state
pass out proto $aprot from any to any flags S/SA keep state
# haute qualite protcols
pass out proto $aprot from any to any port $hq_ports    keep state  #queue h_p_out_m
pass out proto $aprot from any port $hq_ports  to any   keep state  #queue h_p_out_m
#pass in on $ext_if inet proto tcp from port 20 to ($ext_if)  user proxy flags S/SA keep state
# auth/identd
pass in  proto $aprot from any to $birdy port auth keep state  #queue irc_q
pass out proto $aprot from any port auth to <irc_auth> keep state   #queue irc_q
# https, irc, mail
pass out proto $aprot from any to any port $webhq_q_ports keep state
# dns, ntp
pass out proto $aprot from any  to any port $dns_ntp_q_ports keep state
# ssh
pass out proto $aprot from any to any port ssh keep state  #queue h_p_out_m
pass out proto $aprot from any port ssh to any keep state #queue h_p_out_m
# ping
pass proto icmp from any to any  keep state  #queue h_p_out_m
#### RDR PASS
## P2P
#pass in  on $ext_if proto $aprot from any to $adr_p2p port $p2p_ports keep state  #queue p2p_out
#pass out on $ext_if proto $aprot from any port $p2p_ports to any keep state #queue p2p_out
## bittorent
#pass in  quick on $ext_if inet proto $aprot from any to $adr_bt  port $bt_ports keep state
#pass out quick on $ext_if proto $aprot from  any port $bt_ports to any keep state
#pass out quick on $ext_if proto $aprot from  any port 6881 to any keep state
# ipv6/ipv4
#pass in on $ext_if proto $aprot from $addrtunnelipv6 to $alderia           keep state  #queue httpd_out
## service lutsianna
#pass in on $ext_if proto $aprot from any to $lutsianna port lutsianna_svcs keep state  #queue httpd_out
## service alderia
#pass in on $ext_if proto $aprot from any to $alderia   port $alderia_svcs  keep state  #queue httpd_out
## services birdy
#pass in on $ext_if proto $aprot from any to $birdy     port $birdy_svcs    keep state  #queue httpd_out
## services khalia
#pass in on $ext_if proto $aprot from any to $khalia    port $khalia_svcs   keep state  #queue freeplayer
## services conshita
#pass in on $ext_if proto $aprot from any to $conshita  port $conshita_svcs keep state   #queue httpd_out
## services shapai
#pass proto $aprot from any  to any port $shapai_svcs keep state
pass proto $aprot from any port $shapai_svcs to any
pass in on $ext_if proto $aprot from any to lo0 port ssh keep state   #queue h_p_out_m
pass proto $aprot from any  to any port smtp #queue radio_out
pass proto $aprot from any port smtp to any  #queue radio_out
############################################################################################
############################################################################################
#  LOCAL
#########
# mysql pour postfix
#pass out on $int_if proto $aprot from any to $conshita port 3306
# rsync pour les sauvegardes
#pass in  on $int_if proto $aprot from <ip_locales> to $shapai  port  873 keep state
#pass out on $int_if proto $aprot from $shapai  to <ip_locales>  port 873 keep state
# services divers
pass on $int_if proto $aprot from <ip_locales> to $shapai port $shapai_lsvcs
pass on $int_if proto $aprot from $shapai port $shapai_lsvcs to <ip_locales>
#pass quick on $loop  proto $aprot from ($loop) port {25,10024,10025} to ($loop) port  {25,10024,10025}
############################################################################################
############################################################################################
#  IPv6
#########
#
#tunnelbrocker="213.121.24.85"
#tunnelbrocker="139.18.25.33"
ifv6="stf0"
irc_v6="2002:52e7:922b:13x37::1337,200xxxxxxx4a"
birdy_v6="2002qsdfqsdfqsdf:fe05:1ab2"
conshita_v6="200sdfgsdfgsdfg"
lutsianna_v6="2002:52e7:922b:0:208:qsdfqsdfqsdfqdsfdcd"
alderia_v6="2002:52e7:922b::qsdfqdsffffffffffff"
khalia_ipv6="2002:52e7:922b:qdsfffffffffffffffffffff"
shapai_v6="2002:52e7:922b::1qsdffffffffffff
shapaiv6_lan="2002:52e7:922b:1337::0001"
freenode_v6="2001:898:2000:3::1,2001:820:a3::2,sterling.freenode.net,2001:898:2000:3::1,2001:1418:13:1::25"
ircnet_v6=""
table <ipv6_irc_auth_dest>  persist {$irc_v6,$khalia_ipv6}
table <ipv6_irc_auth>  persist {$freenode_v6}
table <ipv6_locales>  persist {$lutsianna_v6,$alderia_v6,$shapaiv6_lan,$irc_v6,$birdy_v6,$shapai_v6,$conshita_v6,$khalia_ipv6}
############################################################################################
############################################################################################
# IPv6 Filter Rules
#########

# bloquer par default
#pass quick inet6  all keep state
block  inet6 all label ipv6
#block log  inet6 all label ipv6
# ping
pass quick inet6 proto icmp6 from any to any  keep state #queue ipv6
# laisser passer ipv6
pass  quick inet6 proto $aprot from <ipv6_locales> to any flags S/SA keep state #queue ipv6
# boucle locale pour le tunnel
pass  quick on $loop   inet6 proto $aprot from any to any  #queue ipv6
# auth ipv6
pass  in inet6 proto $aprot from  <ipv6_irc_auth> to  <ipv6_irc_auth_dest> port auth keep state
#dns
pass  in inet6 proto $aprot to $shapaiv6_lan  port domain keep state
#httpd
pass in  inet6 proto $aprot from any     to $conshita_v6  port http keep state
# dcc et irc
pass  in  inet6 proto $aprot from any to  <ipv6_irc_auth_dest>  port $dcc_ports keep state