# ------
# Macros
# ------

ext_if = "fxp0"
int_if = "fxp1"

ext_services = "{ auth, ssh, ntp }"

int_services = "{ ssh, sunrpc, nfsd, 691, 889 }"

icmp_types = "{ echoreq, unreach }"

martians = "{ 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, \
                10.0.0.0/8, 169.254.0.0/16, 192.0.2.0/24, \
                0.0.0.0/8, 240.0.0.0/4 }"

# ------
# Tables
# ------

table <badguys> persist { 24.64.0.0/13 }
table <brutes> persist

# -------
# Options
# -------

set block-policy return
set loginterface $ext_if

set skip on lo0

# -----
# Scrub
# -----

scrub in on $ext_if #may mess with nfs

# --------
# Queueing
# --------

# -----------
# Translation 
# -----------
nat on $ext_if from !($ext_if) -> ($ext_if:0)

nat-anchor "ftp-proxy/*"
rdr-anchor "ftp-proxy/*"

# -----------
# redirection 
# -----------

rdr pass on $int_if proto tcp to port ftp -> 127.0.0.1 port 8021

# -------------
# Filters Rules
# -------------

#block in log on $ext_if 
block in loganchor "ftp-proxy/*"

antispoof log quick for $ext_if
antispoof log quick for $int_if

pass in on $ext_if inet proto { tcp, udp } from any to ($ext_if) \
        port $ext_services \
        (max-src-conn 100, max-src-conn-rate 2 / 10, \
        overload <brutes> flush)

pass in on $int_if inet proto { tcp, udp } from $int_if:network to $int_if \
        port $int_services

pass in inet proto icmp all icmp-type $icmp_types

pass quick on $int_if

#weird-o's at shaw cable keep scanning
block drop log (all) quick on $ext_if from <badguys>
block drop quick from <brutes>

block drop in quick on $ext_if from $martians to any
block drop out quick on $ext_if from any to $martians

pass out inet