######################################################
############ Macro Definitions #######################
######################################################

# Define all the network interfaces.
ext_if="rl0"
kmkelly_if="em0"
servprise_if="re0"
extranet_if="xl0"

internal_ifs = "{" $kmkelly_if $servprise_if $extranet_if "}"

# External IPs.
citrix_ext_ip = "66.189.62.24"
lgusainc03_ext_ip = "66.189.62.25"
newton_ext_ip = "66.189.62.26"
odysseus_ext_ip = "66.189.62.27"
aristotle_ext_ip = "66.189.62.28"

# Internal IPs.
lgusainc03_int_ip = "10.10.10.2"
citrix_int_ip = "10.10.10.5"
newton_int_ip = "192.168.100.2"
aristotle_int_ip = "192.168.100.3"
odysseus_int_ip = "192.168.100.50"
extranet_int_ip = "192.168.150.2"

# Services we will allow connections to.
icmp_types = "{ echoreq }"
local_services = "{ ssh }"
citrix_services = "{ https }"
lgusainc03_services = "{ https, pptp, smtp, rdc, rww }"
newton_services = "{ http, https }"
aristotle_services = "{ https, pptp, smtp, rww }"
odysseus_services = "{ http, https, ssh }"


####################################################
#################### Options #######################
####################################################

# Drop connections if the port is not opened.
set block-policy drop

# Scrub packets to discard poopy ones.
scrub in all

####################################################
############## Translation Rules ###################
####################################################

# NAT for internal hosts.
nat on $ext_if from !($ext_if) -> ($ext_if:0)

# Forward proper services to lgusainc03, passing through the filtering engine.
rdr pass on $ext_if proto tcp from any to $lgusainc03_ext_ip port $lgusainc03_services -> $lgusainc03_int_ip

# Forward all GRE traffic destined for lguasinc03 (this is needed to enable
# connections to the Windows VPN).
rdr pass on $ext_if proto gre from any to $lgusainc03_ext_ip -> $lgusainc03_int_ip

# Forward proper services to citrix_gateway, passing through the filtering
# engine.
rdr pass on $ext_if proto tcp from any to $citrix_ext_ip port $citrix_services -> $citrix_int_ip

# Forward proper services to newton, passing through the filtering engine.
rdr pass on $ext_if proto tcp from any to $newton_ext_ip port $newton_services -> $newton_int_ip

# Forward proper services to aristotle, passing through the filtering engine.
rdr pass on $ext_if proto tcp from any to $aristotle_ext_ip port $aristotle_services -> $aristotle_int_ip

# Forward all GRE traffic destined for aristotle (this is needed to enable
# connections to the Windows VPN).
rdr pass on $ext_if proto gre from any to $aristotle_ext_ip -> $aristotle_int_ip

# Forward proper services to odysseus, passing through the filtering engine.
rdr pass on $ext_if proto tcp from any to $odysseus_ext_ip port $odysseus_services -> $odysseus_int_ip

###############################################################
################# Filtering Rules #############################
###############################################################

# Protect against spoofed addresses on all interfaces.
antispoof for $ext_if
antispoof for lo
antispoof for $internal_ifs


# By default, block all incoming traffic and allow all outgoing.
# The rules that follow will refine this default stance.
block in on $ext_if
pass out

# Allow all connections on the internal interfaces to pass through.
pass quick on $internal_ifs

# Allow public SSH access.
pass in on $ext_if proto tcp to ($ext_if) port $local_services

# Allow ping requests to echo back.
pass inet proto icmp all icmp-type $icmp_types