##########
# Macros #
##########

ext_if="ex0"
int_if="tlp0"
dmz_if="tlp1"

##########################
# Non-routable addresses #
##########################

nonroutable = "{ 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, \
                 10.0.0.0/8, 169.254.0.0/16, 192.0.2.0/24, \
                 0.0.0.0/8, 240.0.0.0/4 }"

###########
# Options #
###########

set skip on { lo0,  tlp0 }

############
# Services #
############

# Application Ports (not listed in services)
#
# AIM   = 5190
# GTalk = 5222
# ICQ   =
# MSN   =
# YIM   =
# Live! =


tcp_services = "{ ssh, domain, http, https, auth, smtp, smtps, imap, imaps, irc, bootps, bootpc, cvspserver, 5190, 6901, 6891, 6667, 88, 3074, 5222 }"
udp_services = "{ domain, irc, bootps, bootpc, 88, 3074 }"
icmp_services = "{ 0, 30 }"

#########
# Scrub #
#########

scrub in all no-df

###########
# NAT/RDR #
###########

nat on $ext_if from !($ext_if) -> ($ext_if:0)

rdr-anchor miniupnpd
anchor miniupnpd

#############
# antispoof #
#############

antispoof for $ext_if
antispoof for $int_if
antispoof for $dmz_if

################
# Filter Rules #
################

block in log all
block out log all

# Non routable
#block drop in quick on $ext_if from $nonroutable to any
#block drop out quick on $ext_if from any to $nonroutable

# Greenlighted ports
pass in on $ext_if inet proto tcp from any to ($ext_if) port $tcp_services flags S/SA keep state
pass in on $ext_if inet proto udp from any to ($ext_if) port $udp_services keep state

pass out on $ext_if inet proto tcp from ($ext_if) to any port $tcp_services flags S/SA keep state
pass out on $ext_if inet proto udp from ($ext_if) to any port $udp_services keep state

pass in on $int_if inet proto tcp from any to ($int_if) port $tcp_services flags S/SA keep state
pass in on $int_if inet proto udp from any to ($int_if) port $udp_services keep state

pass out on $int_if inet proto tcp from ($int_if) to any port $tcp_services flags S/SA keep state
pass out on $int_if inet proto udp from ($int_if) to any port $udp_services keep state

# ICMP (Ping only for now)
pass out on $ext_if inet proto icmp all icmp-type 8 code 0 keep state
pass out on $int_if inet proto icmp all icmp-type 8 code 0 keep state
pass in on $int_if inet proto icmp all icmp-type 8 code 0 keep state