## Firewall & NAT rules ##

# rl0 is connected to the internet (84.215.128.1/18)
# vr0 is connected to the lan (192.168.1.0/24)

## End info

## Macros

ekstern="rl0"
intern="vr0"

## End macros

## Global options

set skip on lo # Dont need to monitor lo interface
set block-policy drop # Dropper blokkete pakker fremfor a sende TCP-RST
set loginterface rl0 # Her kan det samles statestikk med pfstat, kun et if om gangen
scrub in all # The scrub directive also reassembles fragmented packets,
#protecting some operating systems from some forms of attack, and drops TCP packets that have invalid flag combinations. 

## End global

## Start NAT

nat on $ekstern from $intern:network to any -> ($ekstern)

## End Nat

#block in all
pass out keep state

# ALTQ

altq on $ekstern priq bandwith 1075Kb queue { que_pri, que_def }
queue que_pri priority 7
queue que_def priority 1 (default)

pass in on $ekstern from any to ($ekstern) flags S/SA keep state queue { que_def, que_pri }
pass out on $ekstern from $intern:network to !($ekstern) flags S/SA keep state  queue { que_def, que_pri }


# /ALTQ

#pass in inet proto tcp from any to any port ssh keep state flags S/SA

## Services allowed TO $ekstern



## end TO $ekstern

## Services allowed TO $intern



## end TO $intern