# Schneider Electric Brasil.
# PF Configuration by Guilherme M. Schroeder.

# macros.
int_if="xl0"
ext_if="bge0"
allow_nat="{ 139.158.108.12, 139.158.109.154 }"
networks="{ 139.158.108.0/23, 139.158.2.0/24 \
139.158.110.0/24, 139.158.111.0/24, 10.161.15.0/24 }"

# options.
set block-policy return
set skip on lo
set loginterface $ext_if

# scrub.
scrub all

# nat.
nat on $ext_if inet from $allow_nat to any -> ($ext_if:0)

# default policy block.
block return all

# antispoof.
antispoof quick for { lo, $int_if }

# pass traffic out to internet.
pass out on $ext_if inet proto tcp all flags S/SA modulate state
pass out on $ext_if inet proto { udp, icmp } all keep state

# allow traffic to internal network.
pass in on $int_if inet from $networks to any
pass out on $int_if inet from any to $networks

# allow icmp ping.
pass in inet proto icmp all icmp-type echoreq keep state