# $Id: pf.conf,v 1.4 2007/06/12 05:49:47 scs Exp scs $
# Firewall ruleset for thewall.b1tt3r.org

# Macros

# Interface Macros
# ext_if == WAN
# int_if1 == b1tt3r
# int_if2 == steinbsd
# int_network == internal network (No shit eh?)
# loop == loopback (NO SHIT EH??!?!)

ext_if          = "tun0"
int_if1         = "rl0"
int_if2         = "rl1"
all_ifs         = "{" $ext_if $int_if1 $int_if2 "}"
int_network     = "10/8, 172.16/12"
int_ip1         = "10.0.0.1"
int_ip2         = "172.16.0.1"
intcpservices	= "{ 22, 53, 80 }"
outtcpservices  = "{ 1863,22, 25, 21, 53, 80, 6667, 443 }"
inudpservices	= "{ 53 }"
outudpservices  = "{ 53 }"
icmp_types="echoreq"
# Tables
# noroute == Non-routable addresses

table <noroute> { 127.0.0.1/8, 192.168/16, 172.16/12, 10/8, 255.255.255.255/32 }

#Options
#set optimization aggressive
set block-policy drop
set loginterface $ext_if
#set skip on lo

#Scrub-a-dub-dub
scrub in

#queueing shit.
altq on $ext_if priq bandwidth 100Kb queue { q_pri, q_def }
queue q_pri priority 7
queue q_def priority 1 priq(default)

# Nat and redirection (In that order! VERY IMPORTANT!)
nat on $ext_if from { $int_if1 $int_if2 } -> $ext_if
nat-anchor "ftp-proxy/*"
rdr-anchor "ftp-proxy/*"

rdr pass on $int_if1 proto tcp from any to any port ftp -> 127.0.0.1 port 8021
rdr pass on $ext_if proto {tcp, udp} from any to any port domain -> 10.0.0.2 port domain
rdr pass on $ext_if proto tcp from any to any port ssh -> 10.0.0.30 port ssh

# filter stuff
block log all
pass out from 206.45.95.183 to any keep state
anchor "ftp-proxy/*"
antispoof quick for { lo $int_if1 }
pass in quick on lo0 all
pass out quick on lo0 all


pass in on $ext_if inet proto tcp from any to $ext_if \
   port $intcpservices flags S/SA keep state
pass out on $ext_if inet proto tcp from any to any port $outtcpservices flags S/SA keep state

pass in on $ext_if inet proto udp from any to any \
   port $inudpservices keep state
pass out on $ext_if inet proto udp from any to any \
   port $outudpservices keep state

pass in on $ext_if inet proto tcp from any to 10.0.0.4 port 80 \
    flags S/SA keep state

pass inet proto icmp all icmp-type $icmp_types keep state

pass on $int_if1 all
pass on $int_if2 all
pass quick from $int_if1 to $int_if2
pass quick from $int_if2 to $int_if1 
#pass in on $ext_if proto tcp from any to any port 21 keep state
pass on $ext_if proto tcp from any to any port > 49151 \
   keep state
pass out quick on $ext_if inet proto tcp from ($ext_if) to any port ftp flags S/SA keep state
  pass out quick on $ext_if inet proto tcp from ($ext_if) to any user proxy  flags S/SA keep state

pass out on $ext_if proto tcp from $ext_if to any flags S/SA \
        keep state queue (q_def, q_pri)

pass in  on $ext_if proto tcp from any to $ext_if flags S/SA \
        keep state queue (q_def, q_pri)