#!/bin/sh

# commonly used things
fw="ipfw -q add"
if_ext="bge0"
if_int="bge1"
skip="skipto 30000"

# flush all existing rules
ipfw -q -f flush

# allow things that are always "safe": local network (if_int) and loopback
$fw 100 allow all from any to any via bge1
$fw 200 allow all from any to any via lo0

# nat if the packet is coming in
$fw 1000 divert natd ip from any to any in via $if_ext

# allow packets from previous dynamic rules
$fw 1500 check-state

# allow all outbound connections
$fw 2000 $skip tcp from any to any out via $if_ext setup keep-state
$fw 2001 $skip udp from any to any out via $if_ext keep-state

# allow incoming DNS UDP packets
$fw 2100 allow udp from any to any 53 in via $if_ext
$fw 2200 allow tcp from any to any 53 in via $if_ext

##
## INCOMING PORTS ALLOWED
##

# allow incoming connections for port 2345
$fw 3010 $skip tcp from any to any 2345 in via $if_ext

# VPN
$fw 4001 $skip tcp from any to any 1723 in via $if_ext
$fw 4002 $skip tcp from any to any 1701 in via $if_ext
$fw 4003 $skip 47 from any to any in via $if_ext


# reject all unauthorized incoming
$fw 15000 deny log all from any to any in via $if_ext

# skipto for outbound stateful
$fw 30000 divert natd ip from any to any out via $if_ext
$fw 30001 allow ip from any to any

# deny everything else
$fw 44444 deny log all from any to any