# define some simple macros

thebox = "{ 62, 6200 }"
music = "{ 6000, 6600, 6606, 6882 }"

# define networks
internal = "{ 192.168.1.1, 192.168.1.2, 192.168.1.3, 192.168.1.4, 192.168.1.5, 192.168.1.10, 192.168.1.20, 192.168.1.30 }"
private = "{ 10.0.0.0/8, 169.154.0.0/16, 172.16.0.0/12, 192.168.0.0/24 }"

# set log interface to rl0
set loginterface rl0
# set state policy to bind to interface(s)
set state-policy if-bound

# set default policy to drop
set block-policy drop

# scrub packets
scrub on rl0 reassemble tcp fragment reassemble no-df

# nat internal hosts to the internet
nat on rl0 from 192.168.1.0/24 to any -> (rl0)
#nat on rl0 from $internal to any -> (rl0)

# default deny settings
block drop log all

# enable lo0 quick settings
pass quick on lo0 all

# allow dhcp on rl0
pass out quick on rl0 proto udp from rl0 port 68 to any port 67 keep state

# allow dhcp requests to dc0 from internal hosts
pass in quick on dc0 proto udp from $internal port 68 to dc0 port 67 keep state

# allow dns requests for localhost
pass out quick on rl0 proto udp from rl0 to any port 53 keep state

# outgoing from thebox
pass out on rl0 proto tcp from rl0 to any flags S/SA keep state
pass out on rl0 proto udp from rl0 to any keep state
pass out on rl0 proto tcp from dc0 to any flags S/SA keep state
pass out on rl0 proto udp from dc0 to any keep state
pass out quick on rl0 from rl0 to any flags S/SA keep state

# incoming to thebox for services
pass in on rl0 proto tcp from any to rl0 port 62 flags S/SA keep state
pass in on dc0 proto tcp from $internal to dc0 port 62 flags S/SA keep state
pass in on dc0 proto tcp from $internal to dc0 port 7700 flags S/SA keep state
pass in on rl0 proto tcp from any to rl0 port 7700 flags S/SA keep state 
pass in on rl0 proto tcp from any to rl0 port 6600 flags S/SA keep state
pass in on rl0 proto tcp from any to rl0 port 6606 flags S/SA keep state
pass in on rl0 proto tcp from any to rl0 port 6882 flags S/SA keep state
pass in on rl0 proto tcp from any to rl0 port 7800 flags S/SA keep state
pass in on dc0 proto udp from $internal to dc0 port 53 keep state
pass in on dc0 proto tcp from $internal to dc0 port { 137, 138, 139 } keep state

# outgoing from internal interface to music
pass out on dc0 proto tcp from any to 192.168.1.10 port 6600 keep state
pass out on dc0 proto tcp from any to 192.168.1.10 port 6606 keep state
pass out on dc0 proto tcp from any to 192.168.1.10 port 6882 keep state
pass out on dc0 proto tcp from any to 192.168.1.10 port 7800 keep state

# outgoing from internal interface to internal_network
pass out on dc0 proto tcp from 192.168.1.30 port { 135, 136, 137, 138, 139 } to $internal keep state

# block private networks from coming in on rl0
block drop in on rl0 from $private to rl0

# redirect rules
# redirect to music
#rdr on rl0 proto tcp from any port { 6600, 6606, 6882, 7800 } -> 192.168.1.10

#### END ####