#	$OpenBSD: pf.conf,v 1.34 2007/02/24 19:30:59 millert Exp $
#
# See pf.conf(5) and /usr/share/pf for syntax and examples.
# Remember to set net.inet.ip.forwarding=1 and/or net.inet6.ip6.forwarding=1
# in /etc/sysctl.conf if packets are to be forwarded between interfaces.

ext_if="sis1"
dmz_if="sis0"
int_if="sis2"
wlan_if="ral0"
vpn_if="tun0"
int_net="10.1.1.0/24"
server_ip="192.168.1.1"
lan_ports="{ 20,21,22,25,80,110,113,123,443,445,2049,3066,6667,6900:6999,8021,8025,8080,11750} "
net_ports="{ 20,21,22,25,80,443,445,6667,6900:6999,8080,11750,27000:27050}"
net_portsU=" { 20.21,22,25,80,443,445,6667,6900:6999,8080,11750,27000:27020}"
 

table <spamd-white> persist
table <authpf_users> persist
table <abusers> persist

set skip on lo
scrub in

nat-anchor "authpf/*"
rdr-anchor "authpf/*"
binat-anchor "authpf/*"
nat-anchor "ftp-proxy/*"
rdr-anchor "ftp-proxy/*"
nat on $ext_if from !($ext_if) -> ($ext_if:0)
rdr pass on $ext_if proto tcp to port ftp -> $server_ip port 8021
no rdr on $ext_if proto tcp from <spamd-white> to any port smtp
rdr pass on $ext_if proto tcp from any to any port smtp \
-> $server_ip port spamd
rdr pass on $ext_if proto tcp from any to ($ext_if) port {ssh,8080} -> $server_ip port 22
rdr pass on $ext_if proto tcp from any to ($ext_if) port 11750 -> $server_ip port 11750
rdr pass on $ext_if proto tcp from any to any port 80 -> $server_ip port 80
rdr pass on $ext_if proto tcp from any to any port 443 -> $server_ip port 443

anchor "ftp-proxy/*"
anchor "authpf/*"

block log quick from <abusers>
block in
pass out

pass quick on $int_if no state
antispoof quick for { lo $int_if $vpn_if $wlan_if }

# Wireless traffic
pass in quick on $wlan_if proto tcp to ($wlan_if) port ssh

# Incoming traffic
pass in on $ext_if proto {tcp,udp} from any to any port $net_ports
pass in on $dmz_if proto {tcp,udp} from any to any port $lan_ports
pass in on $int_if proto {tcp,udp} from any to any port $lan_ports

# Outgoing traffic
# pass out log on $ext_if proto tcp from ($ext_if) to port smtp