#
# See pf.old, pf.conf(5), and /usr/share/pf for syntax and examples.
# Remember to set net.inet.ip.forwarding=1 and/or net.inet6.ip6.forwarding=1
# in /etc/sysctl.conf if packets are to be forwardes between interfaces.


# MACROS
        # INTERFACES
ext_if  = "hme0" # Macro for external interface
int_if  = "hme1" # Macro for internal interface
lan_net = "10.0.0.0/8"

                # ext_if IP address could be dynamic, hence ($ext_if)

        # SERVICES
tcp_services = "{ www, https, ftp-data, ftp, ssh, domain, pop3, pop3s, \
                  smtp, auth, nntp, cvspserver, 446, 1863, 2628, 8000, \
                  8080, 6881:6999 }"
udp_services = "{ domain, ntp }"
udp_voip = "{ 5060:5061, 16384:16482 }"
torrents = "{ 15566:15766 }"
icmp_types = "echoreq"


# TABLES
        # SCANNERS TABLE - FOR ATTACKING SCANNERS/PROBES
table <scanners> persist file "/etc/scanners"
table <spammers> persist file "/etc/spammers"

# OPTIONS
        # REQUIRE ORDER
set require-order yes

        # PACKET FEEDBACK
set block-policy drop

        # STATISTICS LOGGING ON
set loginterface $ext_if

        # OPTIMIZATION LEVEL
set optimization normal

        # SKIP PF
set skip on lo0

        # PF STATE KEEPING BEHAVIOR
set state-policy floating


# SCRUB
scrub in on hme0 all no-df
scrub    on hme0 all reassemble tcp


# QUEUEING
#altq on $ext_if hfsc bandwidth 500Kb queue { phone_q, main_q }
#queue phone_q  bandwidth 64Kb  priority 7  hfsc(realtime 64Kb)
#queue main_q   bandwidth 436Kb priority 1  hfsc(default)


# TRANSLATION
        # NAT
nat on $ext_if from !($ext_if) to any -> ($ext_if)

        # WEB SERVER REDIRECT
rdr on $ext_if inet proto tcp to port 9191 -> 10.10.11.1 port 80

        # MAIL SERVER REDIRECT
rdr on $ext_if inet proto tcp from any to $ext_if port 9898 -> 10.10.11.1 port 2
3
rdr on $ext_if inet proto tcp to port 9898 -> 10.10.11.1 port 23

        # FTP ANCHORS
nat-anchor "ftp-proxy/*"
rdr-anchor "ftp-proxy/*"

        # FTP REDIRECTION
rdr on $int_if proto tcp from any to any port 21 -> 127.0.0.1


# FILTER RULES
block log all
block in log on $ext_if proto tcp from <scanners> to ($ext_if) port ssh
pass in  on $int_if from $lan_net to any
pass out on $int_if from any to $lan_net

# Defaults to allow specified traffic to pass
pass out inet proto tcp from $int_if:network to any port $tcp_services \
        flags S/SA modulate state

pass proto udp from $int_if:network to any port $udp_services keep state

# Allow torrent traffic to pass
pass out inet proto tcp from $lan_net to any port $torrents \
        flags S/SA modulate state
pass in inet proto tcp from $lan_net to any port $torrents \
        flags S/SA modulate state

# Allow VOIP phone registration and data
pass proto udp from $int_if:network to any port $udp_voip

# FTP Pass - RDR
pass in on $ext_if inet proto tcp from port ftp-data to ($ext_if) \
        user proxy flags S/SA modulate state

pass in on $ext_if proto tcp from any to ($ext_if) port ssh flags S/SA \
        modulate state (max-src-conn-rate 3/60, overload <scanners> \
        flush global)

anchor "ftp-proxy/*"

pass in on $ext_if inet proto tcp from any to ($ext_if) port ssh

pass inet proto { tcp } to any port $udp_services flags S/SA \
        modulate state

pass inet proto { udp } to any port $udp_services keep state

# Allows queue to be assigned to passing traffic
pass out on $ext_if inet proto tcp from ($ext_if) to any flags S/SA \
        modulate state queue (main_q, phone_q)
pass in  on $ext_if inet proto tcp from any to ($ext_if) flags S/SA \
        modulate state queue (main_q, phone_q)

        # ALLOW PING
pass inet proto icmp all icmp-type $icmp_types keep state

        # ALLOW TRACEROUTE
                # Allow out the default range for traceroute(8):
                # "base+nhops*nqueries-1" (33434+64*3-1)
pass out on $ext_if inet proto udp from any to any \
        port 33433 >< 33626 keep state


        # ANTISPOOFING
antispoof for { $int_if }