#BLOCK ABUSIVE AND OTHER STUPID HOSTS AUTOMAGICALLY

block in quick from <abusive_hosts>


#BLOCK RFC1918 ADDRESSES COMING IN AND BLOCK IP/CIDR BY ADDING TO /ETC/SPAMMERS

block in quick on $ext_if from { <rfc1918>, <spammers> } to any

#PASS IN ROUTER/MODEM
#pass in quick on $ext_if from 192.168.1.1 to any
#pass in quick on $ext_if proto tcp from 192.168.1.1 to $int_if
#pass in quick on rl0 proto tcp from 192.168.1.1 to $int_if
#pass in quick on rl0 proto tcp from 192.168.1.1 to 192.168.0.3

#SPEED UP FTP SERVER INCOMING TRAFFIC

pass in quick on $ext_if proto tcp from any to $host1 port 21 keep state
#pass in quick on $ext_if proto tcp from any to $host1 \
   port > 2047 keep state
#pass in quick on $ext_if proto tcp from any to $host1 port > 49999 keep state
pass in quick on $ext_if proto tcp from any to $host1 port > 2047 keep state


#PASS SINGLE PORT FOR AZUREUS
pass in quick on $ext_if proto { tcp, udp } from any to $host1 \
   port 18734 keep state

pass in quick on $ext_if proto { tcp, udp } from any to $host1 \
   port 55555 keep state

pass in quick on $ext_if proto tcp from any to $host1 port 1025:1050 keep state

#TEST FOR XCHAT
#pass in quick on $ext_if proto { tcp, udp } from any to $host1 \
#   port 113 keep state

#SPEED UP FTP SERVER OUTGOING TRAFFIC

#pass out quick on $int_if proto tcp from any to $host1 port 21 keep state
#pass out quick on $int_if proto tcp from any to $host1 port > 49999 keep state


#MODULATE STATE FOR BETTER PACKET FILTERING PERFORMANCE - HTTP://WWW.OPENBSD.ORG/FAQ/PF/FILTER.HTML

pass out on $ext_if proto { tcp, udp, icmp } from any to any modulate state (if-bound)
#pass out quick on $ext_if proto { tcp, udp } from $host3 to any port 1025:1050
#pass in quick on $ext_if proto { tcp, udp } from any to $host3 port 1025:1050
#ALLOW TRAFFIC IN AND OUT OF THE INTERNAL NETWORK TO THE FIREWALL

pass in quick on $int_if
pass in quick on $int_if from $network to 192.168.0.2
pass out quick on $int_if from 192.168.0.3 to $network

#ALLOW ICMP REQUESTS

pass in inet proto icmp all icmp-type echoreq keep state

#ALLOW DHCP for rl1
pass in quick on rl1 proto { tcp, udp } from any port 67

#ALLOW TRAFFIC FROM THE EXTERNAL INTERFACE TO THE APACHE LISTENING ON XL0/192.168.0.2

#pass in on $ext_if proto tcp from any to xl0 port www flags S/SA synproxy state
pass in quick on $ext_if proto tcp from any to ($ext_if) port 80

#TRY THIS TO SEE IF IT WORKS, SEEMS SMARTER TO FIREWALL AND CONTROL HTTP CONNECTIONS BESIDES HTTPD.CONF
#pass in on $ext_if proto tcp from any to xl0 \
#    port www flags S/SA synproxy state \
#    (max 200, source-track rule, max-src-nodes 100, max-src-states 3 max-src-conn 100, max-src-conn-rate 15/5, overload <ab


#ALLOW SSH AND LOG CONNECTIONS RUNNING ON THE FIREWALL
#pass in quick log on $ext_if proto tcp from any to $ext_if port ssh flags S/SA synproxy state
#pass in quick log on $ext_if proto tcp from any to any port 22 keep state
pass in quick on $ext_if inet proto tcp from any to ($ext_if) port 22 modulate state (source-track rule max-src-nodes 8 max--src-conn 8 max-src-conn-rate 3/60 overload <scanners> flush global)

#ALLOW FTP TRAFFIC IN ON VSFTPD RUNNING ON FIREWALL
pass in on $ext_if proto tcp from any to any port 21 keep state
#pass in on $ext_if proto tcp from any to any port > 49151 \
#   keep state


#block in on $both_ext_if proto { tcp, udp } from any to any port 53
#block in on $both_ext_if proto { tcp, udp } from any to any port 135
#block in on $both_ext_if proto { tcp, udp } from any to any port 137
#block in on $both_ext_if proto { tcp, udp } from any to any port 138
#block in on $both_ext_if proto { tcp, udp } from any to any port 139
#block in on $both_ext_if proto { tcp, udp } from any to any port 427
#block in on $both_ext_if proto { tcp, udp } from any to any port 445
#block in on $both_ext_if proto { tcp, udp } from any to any port 548
#block in on $both_ext_if proto { tcp, udp } from any to any port 593
#block in on $both_ext_if proto { tcp, udp } from any to any port 4444