# Macros: define common values, so they can be referenced and changed easily.
ext_if="em0"
#ext_if="ext0"  # replace with actual external interface name i.e., dc0
int_if="rl0"  # replace with actual internal interface name i.e., dc1

#mail_ports="{ 25, 143, 993 }"
# ftp_ports="{ 20, 21 }"
icmp_types="echoreq"

## SET ###
set block-policy return
set loginterface $ext_if
set skip on lo

# Tables: similar to macros, but more flexible for many addresses.
table <webservers> {207.38.100.130}
# table <mailserver> {207.38.100.130}
table <dnsservers> {67.15.31.131}
table <sshserver> {207.38.100.130}
table <ftpserver> {207.38.100.130}
table <fuder> {207.38.100.130}
## SCRUB ##
# Normalization: reassemble fragments and resolve or reduce traffic ambiguities.
scrub in all


## NAT/TRANSLATION ##
#nat-anchor "pftpx/*"
#rdr-anchor "pftpx/*"
#rdr pass on $ext_if proto tcp from any to any port 21 -> 127.0.0.1 port 8021

## FILTERING RULES##
# block all incoming packets by default
block in log all

# allow SSH into machine
#pass  in  on $ext_if proto tcp from any to <sshserver> port 22 keep state
pass  in  on $ext_if proto tcp from 65.248.20.11 to <sshserver> port 22 keep state
pass  in  on $ext_if proto tcp from 65.248.20.2 to <sshserver> port 22 keep state

# allow fuder
pass  in  on $ext_if proto tcp from any to <fuder> port 8348 keep state

# allow ftp
pass  in  on $ext_if proto tcp from 65.248.20.11 to <ftpserver> port 21 keep state
pass  in  on $ext_if proto tcp from 65.248.20.2 to <ftpserver> port 21 keep state

# allow all outbound connections
pass  out on $ext_if proto { tcp, udp } all keep state

#pass incoming HTTP traffic to main webserver
pass in on $ext_if proto tcp from any to <webservers> port 80 flags S/SAFPRU keep state

# pass ident traffic
pass in on $ext_if proto {tcp, udp} from any to any port 113 keep state

#pass incoming email traffic
#pass in on $ext_if proto tcp from any to <mailserver> port $mail_ports flags S/SAFPRU keep state
#flags S/SA

#pass incoming DNS traffic
pass in on $ext_if proto {tcp, udp} from any to <dnsservers> port 53 keep state

# allow pings
#pass in inet proto icmp all icmp-type $icmp_types keep state
pass in quick inet proto icmp from any to any keep state
pass out inet proto icmp from any to any keep state

# FTP proxy
#anchor "pftpx/*"