# [ /etc/pf.conf ] :: [ EVA ] :: [ by Stealth ][ 2007-08-24 ]

# -----------+
# Interfaces |

int_if = "lo0"
ext_if = "bge0"

# ----+
# IPs |

shield = "80.250.162.163"
ftp_ip = "80.250.162.180"
pro_ip = "80.250.162.181"

# -------------+
# Active VLANs |

vlans = "{ vlan3, vlan4, vlan5, vlan6, vlan7, vlan8, vlan9, vlan10, vlan11 }"

vlan_eva = "vlan2"
vlan_colocation = "vlan1"

# --------+
# Servers |

server_ftp = "10.0.0.49"
server_mail = "10.0.0.180"
server_linux = "10.0.0.33"
server_admin = "10.0.0.105"
server_jabber = "10.0.0.114"

# ---------+
# Services |

icmp_type = "echoreq"
udp_services = "{ domain, ntp }"
tcp_services = "{ ftp-data, ftp, ssh, nameserver, whois, domain, www, auth, \
                ntp, rsync, 5222, 5223, cvspserver, 6667, 49152:49170 }"

# -------+
# Tables |

table <dns> const { \
        10.0.0.1, \
        172.16.3.1, \
        172.16.4.1, \
        172.16.5.1, \
        172.16.6.1, \
        172.16.7.1, \
        172.16.8.1, \
        172.16.9.1, \
        172.16.10.1, \
        172.16.11.1 }

table <colocation> const { \
        80.250.162.182/28, \
        80.250.162.183/28, \
        80.250.162.187/28, \
        80.250.163.82/28, \
        80.250.163.83/28, \
        80.250.163.84/28, \
        80.250.163.85/28, \
        80.250.163.86/28, \
        80.250.163.87/28, \
        80.250.163.88/28, \
        80.250.163.89/28, \
        80.250.163.90/28, \
        80.250.163.91/28, \
        80.250.163.92/28, \
        80.250.163.93/28, \
        80.250.163.94/28 }

table <nat-eva> const { \
        10.0.0.0/22 }

table <nat-vpn> const { \
        10.0.4.0/22 }

table <nat-int> const { \
        172.16.3.0/24, \
        172.16.4.0/24, \
        172.16.5.0/24, \
        172.16.6.0/24, \
        172.16.7.0/24, \
        172.16.9.0/24, \
        172.16.8.0/24, \
        172.16.10.0/24, \
        172.16.11.0/24 }

table <servers> const { \
        $server_ftp \
        $server_mail \
        $server_linux \
        $server_admin \
        $server_jabber }

table <ban-list> persist

# --------+
# Options |

set optimization satellite

set state-policy if-bound

set skip on $int_if

set loginterface $ext_if

# ----------+
# Scrubbing |

scrub on $ext_if fragment drop-ovl

# ----+
# NAT |

nat on $ext_if inet from { <nat-eva>, <nat-int> } -> ($ext_if)

# ---------+
# Proxying |

# share
rdr pass proto tcp to $ftp_ip -> $server_ftp

# mail
rdr pass proto { udp, tcp } to $pro_ip port { smtp, imap, imaps, submission } -> $server_mail
rdr pass proto { udp, tcp } from $server_mail port smtp -> $pro_ip

# linux
rdr pass proto tcp to $pro_ip port ssh -> $server_linux

# jabber
rdr pass proto tcp to $pro_ip port { 5222, 5223 } -> $server_jabber

# ------------+
# Redirection |

# NOTE: ftp -- 51k / ssh -- 52k / https -- 53k

# giirt
rdr pass proto tcp to $pro_ip port 53056 -> 10.0.0.56 port https

# 1514
rdr pass proto tcp to $pro_ip port 51061 -> 10.0.0.61 port ftp
rdr pass proto tcp to $pro_ip port 52061 -> 10.0.0.61 port ssh

# admin
rdr pass proto tcp to $pro_ip port 51105 -> 10.0.0.105 port ftp

# wikitest
rdr pass proto tcp to $pro_ip port 51118 -> 10.0.0.118 port ftp
rdr pass proto tcp to $pro_ip port 52118 -> 10.0.0.118 port ssh

# hosting
rdr pass proto tcp to $pro_ip port 52121 -> 10.0.0.121 port ssh

# monitoring
rdr pass proto tcp to $pro_ip port 52126 -> 10.0.0.126 port ssh

# ZenGeist
rdr pass proto tcp to $pro_ip port 54001 -> 172.16.11.63 port ssh
rdr pass proto tcp to $pro_ip port 54002 -> 172.16.4.63 port ssh
rdr pass proto tcp to $pro_ip port 54003 -> 172.16.3.57 port ssh

# --------------------+
# Spoofing protection |

antispoof log for $ext_if

# ---------+
# Ban list |

block log from <ban-list>

# --------------+
# Carte blanche |

block in log

# icmp
pass inet proto icmp icmp-type $icmp_type

# freedom::in
pass in log on $ext_if proto udp to port $udp_services
pass in log on $ext_if proto tcp to port $tcp_services

# freedom::out
pass out log on $ext_if modulate state

# freedom::shield
pass log on $ext_if proto tcp to $shield port 60000

# freedom::vlans
pass in on $vlans to { !<nat-int>, <dns> }
pass out on $vlans from { !<nat-eva>, <servers> }

# freedom::vlans::eva
pass in on $vlan_eva from { <nat-eva>, <nat-vpn> }
pass out on $vlan_eva to <servers>
pass out on $vlan_eva from !<nat-int>

# freedom::colocation
pass log to <colocation>
pass log from <colocation> to { !<nat-eva>, $server_mail }

# freedom::vpn
pass log on tu