### Macros ###
ext_if = "vr0"
int_if_voip = "vr2"
int_if_office = "vr1"
internal_net_voip = "192.168.101.0/24"
internal_net_office = "192.168.100.0/24"

portier_ip = "192.168.100.29/32"


#### Tables ###
table <http-ban> persist

### Options ###
set timeout { interval 10, frag 30 }
set timeout { tcp.first 120, tcp.opening 30, tcp.established 86400 }
set timeout { tcp.closing 900, tcp.finwait 45, tcp.closed 90 }
set timeout { udp.first 60, udp.single 30, udp.multiple 60 }
set timeout { icmp.first 20, icmp.error 10 }
set timeout { other.first 60, other.single 30, other.multiple 60 }
set timeout { adaptive.start 0, adaptive.end 0 }
set limit { states 10000, frags 5000 }
set loginterface $ext_if
set optimization normal
set block-policy drop
set require-order yes
set fingerprints "/etc/pf.os"

set skip on lo0


### Normalization ###
scrub in all

### Queuing ###

altq on $ext_if bandwidth 8640Kb hfsc(linkshare 8640Kb upperlimit 8640Kb) queue { o_low, o_high }

queue o_low bandwidth 8000Kb priority 7 hfsc(linkshare 8000Kb default)
queue o_high bandwidth 640Kb priority 8 hfsc(realtime 4096Kb)

### Filtering ###

# Implicit rules
pass in all
pass out all

# Block rules
block in on $ext_if all
block in quick on $ext_if from <http-ban>

# out rule
pass out on $ext_if proto { udp, tcp, icmp } from any to any keep state

# SIP in
pass in on $ext_if proto { udp, tcp } from any to $ext_if port 5060 keep state queue o_high

# RTP in
pass in on $ext_if proto { udp, tcp } from any to $ext_if port 10000:10200 keep state queue o_high

# SIP out
pass out on $ext_if proto { tcp, udp } from any to any port 5060 keep state queue o_high

# RTP out
pass out on $ext_if proto { tcp, udp } from any to any port 10000:10200 keep state queue o_high