#!/bin/sh

ipfw -q -f flush

cmd="ipfw -q add"
skip="skipto 800"
pif="bge0"

#################################################################
# No restrictions on Inside LAN Interface for private network
# Change xl0 to your LAN NIC interface name
#################################################################
$cmd 005 allow all from any to any via bge1
$cmd 006 allow all from any to any via hme4

#################################################################
# No restrictions on Loopback Interface
#################################################################
$cmd 010 allow all from any to any via lo0

#################################################################
# check if packet is inbound and nat address if it is
#################################################################
$cmd 014 divert natd ip from any to any in via $pif

#################################################################
# Allow the packet through if it has previous been added to the
# the "dynamic" rules table by a allow keep-state statement.
#################################################################
$cmd 015 check-state

#################################################################
# Interface facing Public Internet (Outbound Section)
# Interrogate session start requests originating from behind the
# firewall on the private network or from this gateway server
# destine for the public Internet.
#################################################################

#$cmd 020 $skip all from any to any out via $pif
$cmd 021 allow tcp from 10.10.1.0/24 to any setup keep-state
$cmd 022 allow udp from 10.10.1.0/24 to any setup keep-state

#################################################################
# Interface facing Public Internet (Inbound Section)
# Interrogate packets originating from the public Internet
# destine for this gateway server or the private network.
#################################################################

# Deny all inbound traffic from non-routable reserved address spaces
$cmd 300 deny all from 192.168.0.0/16  to any in via $pif  #RFC 1918 private IP
$cmd 301 deny all from 172.16.0.0/12   to any in via $pif  #RFC 1918 private IP
$cmd 302 deny all from 10.0.0.0/8      to any in via $pif  #RFC 1918 private IP
$cmd 303 deny all from 127.0.0.0/8     to any in via $pif  #loopback
$cmd 304 deny all from 0.0.0.0/8       to any in via $pif  #loopback
$cmd 305 deny all from 169.254.0.0/16  to any in via $pif  #DHCP auto-config
$cmd 306 deny all from 192.0.2.0/24    to any in via $pif  #reserved for docs
$cmd 307 deny all from 204.152.64.0/23 to any in via $pif  #Sun cluster
$cmd 308 deny all from 224.0.0.0/3     to any in via $pif  #Class D & E multicast

# always allow anything from Chegg to grace our network
#$cmd 320 allow all from 205.253.147.122 to me in via $pif setup limit src-addr 5

# allow all service ports that are ru here
$cmd 350 allow tcp from any to me 1723 in via $pif setup limit src-addr 2
$cmd 360 allow udp from any to me 1701 in via $pif setup limit src-addr 2
$cmd 370 allow 47 from any to me in via $pif setup limit src-addr 2
$cmd 400 allow tcp from any to me 80 in via $pif setup limit src-addr 4
$cmd 401 allow tcp from any to me 20 in via $pif setup limit src-addr 2
$cmd 402 allow tcp from any to me 21 in via $pif setup limit src-addr 2
$cmd 403 allow tcp from any to me 22 in via $pif setup limit src-addr 2
$cmd 404 allow tcp from any to me 23 in via $pif setup limit src-addr 2
$cmd 405 allow tcp from any to me 25 in via $pif setup limit src-addr 2
$cmd 406 allow tcp from any to me 53 in via $pif setup limit src-addr 2
$cmd 407 allow tcp from any to me 110 in via $pif setup limit src-addr 2
$cmd 408 allow tcp from any to me 143 in via $pif setup limit src-addr 2
$cmd 409 allow tcp from any to me 8080 in via $pif setup limit src-addr 2
$cmd 410 allow tcp from any to me 8181 in via $pif setup limit src-addr 2
$cmd 411 allow tcp from any to me 8000 in via $pif setup limit src-addr 2
$cmd 412 allow tcp from any to me 9284 in via $pif setup limit src-addr 2
$cmd 413 allow tcp from any to me 2121 in via $pif setup limit src-addr 2
$cmd 414 allow tcp from any to me 3389 in via $pif setup limit src-addr 2
$cmd 415 allow tcp from any to me 8118 in via $pif setup limit src-addr 2

$cmd 419 allow tcp from any to any in $ks
$cmd 420 allow udp from any to any in $ks

# Reject & Log all unauthorized incoming connections from the public Internet
$cmd 440 deny log all from any to any in via $pif

# This is skipto location for outbound stateful rules
$cmd 800 divert natd ip from any to any out via $pif
$cmd 801 allow ip from any to any

# Everything else is denied by default
# deny and log all packets that fell through to see what they are
$cmd 999 deny log all from any to any
################ End of IPFW rules file ###############################