########################################################
# macro definitions
#-------------------------------------------------------

ext_if="fxp0"
int_if="xl0"
wlan_if="wi0"


#-------------------------------------------------
# Options
#-------------------------------------------------
set skip on { lo $int_if $wlan_if }
set block-policy drop

scrub in

nat on $ext_if from !($ext_if) -> ($ext_if:0)

# Spamd whitelist table
table <spamd-white> persist

# Spamd and Postfix redirect on external interface. If in whitelist table go to Postfix.
# If not in whitelist table go to spamd.
rdr on $ext_if proto tcp from  <spamd-white> to ($ext_if) port smtp -> lo0 port smtp
rdr on $ext_if proto tcp from !<spamd-white> to ($ext_if) port smtp -> lo0 port spamd

# Postfix Mail Server (internal interface) redirect for internal hosts.
rdr on $int_if proto tcp from { 192.168.1.105 127.0.0.1 } to $int_if port smtp -> lo0 port smtp

# Dovecot pop3s/imap Server (internal interface) redirect for internal hosts.
rdr on $int_if proto tcp from any to $int_if port imaps -> lo0 port imaps


#-------
# Set default policy
#------

block in log all
block out log all

#------------------------------------------------
# Anti-spoof rules
#------------------------------------------------

block in log quick on $wlan_if proto tcp from 192.168.2.200 to any port 25

pass out log on { $ext_if $int_if } modulate state

# Allow traffic for spamd from outside. Synproxy the connection.
pass in log quick on $ext_if inet proto tcp from any to lo0 port spamd flags S/SAFPRU synproxy state

# Allow traffic for postfix mail server from anyone on the outside and the inside.
pass in log on $ext_if inet proto tcp from any to lo0 port smtp flags S/SAFPRU synproxy state

# Allow traffic to Dovecot pop3 server from any network on the inside. Change to external if needed.
pass in log on $int_if inet proto tcp from any to lo0 port imaps flags S/SAFPRU keep state


# Allow ping of the firewall (including VIPs), easier to debug
pass in log quick inet proto icmp from any to self icmp-type echoreq keep state
pass in log on $ext_if inet proto tcp from any to any port 80 keep state
pass in log on $ext_if inet proto tcp from any to any port 25 keep state