WAN="hme1"
LAN="hme2"
WLAN="hme3"
DMZ1="hme4"
DMZ2="hme5"
DMZ3="hme6"
IPV6="gif0"

table <firewall> const {self}

table <IPSpoof-LAN> file "/etc/pf/spoofing/IPSpoof-LAN"
table <IPSpoof-WLAN> file "/etc/pf/spoofing/IPSpoof-WLAN"
table <IPSpoof-DMZ1> file "/etc/pf/spoofing/IPSpoof-DMZ1"
table <IPSpoof-DMZ2> file "/etc/pf/spoofing/IPSpoof-DMZ2"
table <IPSpoof-DMZ3> file "/etc/pf/spoofing/IPSpoof-DMZ3"

table <LocalNetworks> file "/etc/pf/spoofing/IPSpoof-Networks"

table <DNS-Servers> file "/etc/pf/services/DNS-Servers"
table <defaultdrop> file "/etc/pf/default/defaultdrop"
table <dropicmp>    file "/etc/pf/default/dropicmp"

INTERNET="{! <LocalNetworks> }"

set skip on lo
set loginterface hme0
set block-policy drop

scrub in

# ------------------------- NAT -------------------------------

nat on $WAN from <IPSpoof-LAN> to $INTERNET -> ($WAN)                                                   # vr: LAN  HIDE-NAT
nat on $WAN from <IPSpoof-WLAN> to $INTERNET -> ($WAN)                                                  # vr: WLAN HIDE-NAT

# ------------------------- RDR -------------------------------

nat-anchor "ftp-proxy/*"
rdr-anchor "ftp-proxy/*"

rdr pass on $LAN proto tcp from <IPSpoof-LAN> to any port 21 -> 127.0.0.1 port 8021
rdr pass on $WLAN proto tcp from <IPSpoof-WLAN> to any port 21 -> 127.0.0.1 port 8021
# rdr pass on $WAN proto tcp from any to any port 80 -> 192.168.3.2 port 80

# ----------------------- DEFAULT -----------------------------

# DEFAULT DROP
block log
block log quick from <defaultdrop>                                                                      # vr: Block Specific Users
block log quick proto icmp from <dropicmp>                                                              # vr: Disable ICMP for Specific Users

# SPOOFING
block in log quick on $WAN from <IPSpoof-LAN> to any
block in log quick on $WAN from <IPSpoof-WLAN> to any
block in log quick on $WAN from <IPSpoof-DMZ1> to any
block in log quick on $WAN from <IPSpoof-DMZ2> to any
block in log quick on $WAN from <IPSpoof-DMZ3> to any

block in log quick on ! $LAN from <IPSpoof-LAN> to any
block in log quick from ($LAN) to any
block in log quick on ! $WLAN from <IPSpoof-WLAN> to any
block in log quick from ($WLAN) to any
block in log quick on ! $DMZ1 from <IPSpoof-DMZ1> to any
block in log quick from ($DMZ1) to any
block in log quick on ! $DMZ2 from <IPSpoof-DMZ2> to any
block in log quick from ($DMZ2) to any
block in log quick on ! $DMZ3 from <IPSpoof-DMZ3> to any
block in log quick from ($DMZ3) to any

# ------------------------ INHERIT ----------------------------

pass log quick from <firewall> to any keep state                                                        # vr: Allows the Firewall to talk to *
pass log quick inet proto icmp from $INTERNET to ($WAN) icmp-type echoreq keep state                    # vr: WAN Interface Pingable

# ------------------------- POLICY ----------------------------

pass log quick inet proto tcp from any to 192.168.3.2 port 80 keep state

# LAN <> ANY
pass log quick inet proto icmp from <IPSpoof-LAN> to any icmp-type echoreq keep state                   # vr: ICMP/echo
pass log quick inet proto udp from <IPSpoof-LAN> to any port 33000><33999 keep state                    # vr: TRACEROUTE

# LAN <> WLAN
pass log quick from <IPSpoof-LAN> to <IPSpoof-WLAN> keep state                                          # vr: Access WLAN
pass log quick inet proto tcp from <IPSpoof-WLAN> to <firewall> port 22 keep state
pass log quick inet proto tcp from <IPSpoof-WLAN> to 192.168.1.101 port 80 keep state                   # vr: Access to mythtv

# LAN <> WAN
pass log quick proto udp from <IPSpoof-LAN> to <DNS-Servers> port 53 keep state                         # vr: DNS
pass log quick from <IPSpoof-LAN> to $INTERNET keep state                                               # vr: Internet Access for LAN

# LAN <> DMZ1
pass log quick from <IPSpoof-LAN> to <IPSpoof-DMZ1> keep state                                          # vr: Access to DMZ1
pass log quick from <IPSpoof-DMZ1> to $INTERNET keep state                                              # vr: DMZ DNS

# WLAN <> WAN
pass log quick proto udp from <IPSpoof-WLAN> to <DNS-Servers> port 53 keep state                        # vr: DNS
pass log quick from <IPSpoof-WLAN> to $INTERNET keep state                                              # vr: Internet Access for WLAN

# FIREWALL
pass log quick proto tcp from <IPSpoof-LAN> to ($LAN) port 22 keep state                                # vr: SSH ACCESS FROM LAN
pass log quick proto tcp from <IPSpoof-LAN> to ($LAN) port 8021 keep state                              # vr: SSH ACCESS FROM LAN
pass log quick proto tcp from $INTERNET to ($WAN) port 22 keep state                                    # vr: SSH ACCESS FROM INTERNET

anchor "ftp-proxy/*"
pass out proto tcp from <firewall> to any port 21 keep state


block log quick to <firewall>                                                                           # vr: FIREWALL CATCHALL