## SmartServ Hosting PF Config
## Jeremy Johnston <jeremy@smart-serv.net>

## Options
set fingerprints "/etc/pf.os"
# return, drop
set block-policy drop

## Macros
ext_if = "fxp0"
tcp_ports = "{ 21, 22, 25, 53, 80, 79, 110, 113, 143, 443, 873, 993, 995, 6000, 6660:6670, 10000><20000 }"
udp_ports = "{ 53, 79, 113 }"

## Tables
table <trust> persist file "/etc/pf.trusted"
table <blackhole> persist file "/etc/pf.blackholes"

## Rules
scrub in all

pass in quick on $ext_if from <trust>
block in quick on $ext_if from <blackhole>

block in on $ext_if all

pass in quick inet proto icmp all icmp-type 8 code 0 keep state
pass in quick inet6 all

pass in quick on $ext_if proto tcp from any to $ext_if port $tcp_ports flags S/SA keep state
pass in quick on $ext_if proto udp from any to $ext_if port $udp_ports

pass out on $ext_if proto tcp all modulate state flags S/SA
pass out on $ext_if proto { udp, icmp } all keep state