table <trustednet> { 10/8, 192.168/16 } persist
table <untrustednet> { 172.16/12 } persist
table <badhosts> persist file "/home/helio/badhosts"
set skip on lo

scrub in



altq on sis0 priq bandwidth 7Mb queue { std_out, tcp_ack_out, http_out }
queue std_out priq(default)
queue tcp_ack_out priority 6
queue http_out priority 4 priq(red)


nat on egress inet from { <trustednet>, <untrustednet> } -> (egress)
#rdr pass on $ext_if proto tcp from <spamd> to port smtp \
#       -> 127.0.0.1 port spamd
#rdr pass on $ext_if proto tcp from !<spamd-white> to port smtp \
#       -> 127.0.0.1 port spamd

# default rule
block in

# openbsd 4.0 vuln workaround
block quick inet6 all

antispoof for { lo egress ingress }


pass in on egress proto tcp from any to (egress) port ssh

# everything on ingress can get dhcp leases and do dns
pass in on ingress proto udp from any to any port bootpc modulate state 

# everything in the trusted network can be allowed in, but not to untrusted.
pass in on trusted proto { tcp, udp, icmp } from <trustednet> to !<untrustednet> modulate state flags S/SA
pass in on untrusted proto { tcp, udp, icmp } from <untrustednet> to !<trustednet> modulate state flags S/SA

# allow ssh in on ingress
pass in on ingress proto tcp from { <trustednet>, <untrustednet> } to (ingress) port { ssh } modulate state flags S/SA
pass in on ingress proto udp to port tftp modulate state
pass in on ingress proto udp from { <trustednet>, <untrustednet> } to (ingress) port { ntp } modulate state
pass in on ingress proto tcp from { <trustednet> } to (ingress) port ftp modulate state flags S/SA
pass out modulate state flags S/SA

# block netbeui
block in proto { tcp, udp } from any to any port { 137, 138, 139, 445 } 



# queue rules

pass out on egress proto { tcp, udp} from any to any port domain queue dns_in
pass out on egress proto tcp from any to any flags S/SA queue tcp_ack_out
pass out on egress proto tcp from any to any port { 80, 443 } keep state flags S/SA queue http_out