barge# pfctl -s rules scrub in on tun0 all no-df random-id min-ttl 15 fragment reassemble block drop in on tun0 all pass out all keep state block drop in quick on ! lo inet6 from ::1 to any block drop in quick on ! lo inet from 127.0.0.0/8 to any block drop in quick on lo0 inet6 from fe80::1 to any block drop in quick inet6 from ::1 to any block drop in quick inet from 127.0.0.1 to any block drop in quick on ! xl0 inet from 192.168.0.0/24 to any block drop in quick inet from 192.168.0.2 to any block drop in quick on ! rl1 inet from 192.168.2.0/24 to any block drop in quick inet from 192.168.2.2 to any block drop in quick from to any block drop in quick on tun0 from to any block drop in quick on tun0 from to any pass in quick on tun0 inet proto tcp from any to 192.168.0.3 port = ftp keep state pass in quick on tun0 inet proto tcp from any to 192.168.0.3 port > 2047 keep state pass in quick on tun0 inet proto tcp from any to 192.168.0.3 port = 18734 keep state pass in quick on tun0 inet proto udp from any to 192.168.0.3 port = 18734 keep state pass in quick on tun0 inet proto tcp from any to 192.168.0.3 port = 55555 keep state pass in quick on tun0 inet proto udp from any to 192.168.0.3 port = 55555 keep state pass in quick on tun0 inet proto tcp from any to 192.168.0.3 port 1025:1050 keep state pass out on tun0 proto tcp all modulate state (if-bound) pass out on tun0 proto udp all keep state (if-bound) pass out on tun0 proto icmp all keep state (if-bound) pass in quick on rl1 all pass in quick on xl0 all pass in quick on rl1 inet from 192.168.0.3 to 192.168.0.2 pass in quick on rl1 inet from 192.168.0.5 to 192.168.0.2 pass in quick on rl1 inet from 192.168.2.4 to 192.168.0.2 pass in quick on xl0 inet from 192.168.0.3 to 192.168.0.2 pass in quick on xl0 inet from 192.168.0.5 to 192.168.0.2 pass in quick on xl0 inet from 192.168.2.4 to 192.168.0.2 pass out quick on rl1 inet from 192.168.0.3 to 192.168.0.3 pass out quick on rl1 inet from 192.168.0.3 to 192.168.0.5 pass out quick on rl1 inet from 192.168.0.3 to 192.168.2.4 pass out quick on xl0 inet from 192.168.0.3 to 192.168.0.3 pass out quick on xl0 inet from 192.168.0.3 to 192.168.0.5 pass out quick on xl0 inet from 192.168.0.3 to 192.168.2.4 pass in inet proto icmp all icmp-type echoreq keep state pass in quick on rl1 proto tcp from any port = bootps to any pass in quick on rl1 proto udp from any port = bootps to any pass in quick on tun0 proto tcp from any to (tun0) port = http pass in quick on tun0 inet proto tcp from any to (tun0) port = ssh modulate state (source-track rule, max-src-conn 8, max-src-conn-rate 3/60, max-src-nodes 8, overload flush global, src.track 60) pass in on tun0 proto tcp from any to any port = ftp keep state