##########
# Macros #
##########

ext_if="ex0"
int_if="tlp0"
dmz_if="tlp1"

ext=$int_if:network
int=$int_if:network
dmz=$dmz_if:network

##########################
# Non-routable addresses #
##########################

nonroutable = "{ 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, \
                 10.0.0.0/8, 169.254.0.0/16, 192.0.2.0/24, \
                 0.0.0.0/8, 240.0.0.0/4 }"

###########
# Options #
###########

set block-policy drop
set loginterface $ext_if

############
# Services #
############

tcp_services = "{ ssh, domain, http, https, auth, smtp, smtps, imap, imaps, irc }"
udp_services = "{ domain, irc }"
icmp_services = "{ echoreq }"

#########
# Scrub #
#########

scrub no-df random-id fragment reassemble

#############
# antispoof #
#############

antispoof for $ext_if
antispoof for $int_if
antispoof for $dmz_if

###########
# NAT/RDR #
###########

nat on $ext_if from !($ext_if) to any -> ($ext_if)
nat on $int_if from !($int_if) to any -> ($int_if)
nat on $dmz_if from !($dmz_if) to any -> ($dmz_if)

################
# Filter Rules #
################

block in quick on $ext_if

# SSH
pass in quick on $ext_if proto tcp from any to any port 22 flags S/SA keep state

# Non routable
block drop in quick on $ext_if from $nonroutable to any
block drop out quick on $ext_if from any to $nonroutable

# Greenlighted ports
pass in on $ext_if inet proto tcp from any to ($ext_if) \
   port $tcp_services flags S/SA keep state
pass in on $ext_if inet proto udp from any to ($ext_if) \
   port $udp_services keep state