# Options
set fingerprints "/etc/pf.os"

#### My Crap #####
# Macros
ext_if = "xl0"
int_if = "xl1"
int1_if = "xl2"
static_net = "10.0.1.0/25"
int_ifs = "{ xl1, xl2 }"
ssh_ports = "{ 22, 3290 }"
tcp_rdr_ports = "{ 20, 21, 22, 25, 53, 56, 80, 110, 8921, 9000, 9001, 8100, 143, 443 }"
udp_rdr_ports = "{ 20, 21, 53, 143, 1910, 8921 }"

table <bruteforce> persist
table <bruteforce6> persist
table <dhcp_net> { 10.0.1.128/25 }

# Block stuff first
# Normalization: reassemble fragments and resolve or reduce traffic ambiguities.
scrub in all

# NAT The internal nets
nat on $ext_if from $static_net to any -> ($ext_if)

# Redirects
rdr on $ext_if proto tcp from any to $ext_if port $tcp_rdr_ports -> 10.0.1.2
rdr on $ext_if proto udp from any to $ext_if port $udp_rdr_ports -> 10.0.1.2
pass proto tcp from any to 10.0.1.2 port $tcp_rdr_ports flags S/SA keep state

# Block between
#block drop in quick on $ext_if from $martians to any
#block drop out quick on $ext_if from any to $martians
block drop in on $int_ifs from <dhcp_net> to any
block drop out on $int_ifs from any to <dhcp_net>

# Block Spoofs
antispoof for $ext_if

# SSH Flooding (For both router and server(s)
block quick from <bruteforce>
pass quick proto { tcp, udp } from any to any port $ssh_ports flags S/SA keep state (max-src-conn 5, max-src-conn-rate 5/3, overload <bruteforce> flush global)
pass quick inet6 proto { tcp, udp } from any to any flags S/SA keep state (max-src-conn 5, max-src-conn-rate 5/3, overload <bruteforce6> flush global)

# Block Other
block in quick inet6 from any to 2001:4830:2018:f0::/60
block in quick inet from 210.0.0.0/7 to any
block in quick inet from 222.0.0.0/8 to any

# IPv6 Stuff
pass in quick inet6 from 2001:4830:2018::/48 to 2001:4830:2018:f0::/60