### CONSTANTS ###

#ethernet interfaces
internal = "fxp0"
external = "xl0"

#services running on the server
services = "{ ssh, http, ftp }"

icmp_types = "echoreq"

#list of non routable IPs
nonroutable = "{ 192.168.0.0/16,    127.0.0.0/8,     172.16.0.0/12,  \
                 10.0.0.0/8,        0.0.0.0/8,       169.254.0.0/16, \
                 192.0.2.0/24,      204.152.64.0/23, 224.0.0.0/3,    \
                 255.255.255.255/32 }"

#################

### OPTIONS ###

set block-policy return
set loginterface $external
set skip on lo0

##############

### SCRUB ###

scrub in all
############

### NAT ###

nat on $external from 192.168.1.0/24 to any -> $external

###########

### REDIRECTS TO LOCAL MACHINE ###

#redirect access to apocalipse apache
rdr pass on $external proto tcp from any to any port 8064 -> 192.168.1.64 port 80
rdr pass on $external proto tcp from any to any port 2264 -> 192.168.1.64 port 22
rdr pass on $external proto tcp from any to any port 6881 -> 192.168.1.64 port 6881
rdr pass on $external proto udp from any to any port 4444 -> 192.168.1.64 port 4444 
rdr pass on $internal proto tcp from any to any port 21 -> 127.0.0.1 \
   port 8021

###################################

### FILTER RULES ###

block all

block drop in quick on $external from $nonroutable
block drop out quick on $external from any to $nonroutable

pass in on $external inet proto tcp from any to $external \
    port $services flags S/SA keep state

pass in on $external inet proto tcp from port 20 to $external \
    user proxy flags S/SA keep state

#allow FTP connections
pass in on $external proto tcp from any to any port > 49151 \
   keep state

pass in inet proto icmp all icmp-type $icmp_types keep state

pass in quick on $internal from $internal:network to any keep state
pass out quick on $internal from any to $internal:network keep state

pass out on $external proto tcp all modulate state flags S/SA
pass out on $external proto { udp, icmp } all keep state 


### EOF ###