cmd="ipfw -q add"
skip="skip to 500"
pif="rl0"
ks="keep-state"

good_tcpo="22,25,37,43,53,80,443,110,119,5050,5051,5100"
bad_tcpo="135,137,138,139,445"

ipfw -q -f flush

$cmd 002 allow all from any to any via xl0
$cmd 003 allow all from any to any via lo0
$cmd 100 divert natd ip from any to any in via $pif
$cmd 101 check-state

### Outbond Public Interface
$cmd 120 $skip udp from any to 202.122.9.242 53 out via $pif $ks
$cmd 121 $skip tcp from any to 202.122.9.242 53 out via $pif $ks
$cmd 122 $skip tcp from any to $good_tcpo out via $pif setup $ks
$cmd 130 $skip icmp from any to any out via $pif $ks
$cmd 135 $skip udp from any to any out via $pif

### Inbound Public Interface
$cmd 300 deny all from 192.168.0.0/16 to any in via $pif
$cmd 301 deny all from 172.16.0.0/12 to any in via $pif
$cmd 302 deny all from 10.0.0.0/8 to any in via $pif
$cmd 303 deny all from 127.0.0.0/8 to any in via $pif
$cmd 304 deny all from 0.0.0.0/8 to any in via $pif
$cmd 305 deny all from 169.254.0.0/16 to any in via $pif
$cmd 306 deny all from 192.0.2.0/24 to any in via $pif
$cmd 307 deny all from 204.152.64.0/23 to any in via $pif
$cmd 308 deny all from 224.0.0.0/3 to any in via $pif

$cmd 320 deny tcp from any to any $bad_tcpo in via $pif
$cmd 321 deny udp from any to any $bad_tcpo in via $pif

$cmd 330 deny all from any to any frag in via $pif

# natd
$cmd 500 divert natd ip from any to any out via $pif
$cmd 510 allow ip from any to any

$cmd 600 allow tcp from 192.168.13.222 to any 80
$cmd 601 fwd 192.168.1.254,9000 tcp from any to any 80 recv rl1

$cmd 700 deny log ip from any to any