# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
#
# This configuration is set for use on a machine that is a router with
# three (3) network cards:
# ext_if - connects to the upstream link (cable/dsl modem, WAN, etc.)
# wifi_if - wireless card for internal network
#           (if none present, remove all references to it in this file)
# lan_if  - wired card for internal network
#           (if none present, remove all references to it in this file)
#
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
#------------------------------------------------------------------------
# macros
#------------------------------------------------------------------------
logopt = "log"
# interfaces
ext_if  = "bge0"
wifi_if = "ath0"

#------------------------------------------------------------------------
# options
#------------------------------------------------------------------------
# config
set block-policy return
set loginterface $ext_if # ??????
set skip on lo0 # alloy all local traffic
# scrub
scrub all reassemble tcp no-df
scrub in all fragment reassemble
scrub out all random-id

nat on $ext_if from (!ext_if) to any tagged to_nat-> ($ext_if:0)

#------------------------------------------------------------------------
# firewall policy
#------------------------------------------------------------------------
# restrictive default rules
#block all
pass in quick on $ext_if to $ext_if keep state tag ok   ### - allow traffic to local services
pass in quick on $wifi_if to $wifi_if keep state tag ok ### - (modify rules to limit access to local services)

pass in  quick on $wifi_inf to !$wifi_inf:network keep state tag to_nat ### modify rute to filter traffic true nat

pass out quick on $ext_if tagged to_nat
pass quick tagged ok
block log all





Internet:
Destination        Gateway            Flags    Refs      Use  Netif Expire
default            home               UGS         0     9321   bge0
localhost          localhost          UH          0    15243    lo0
192.168.0          link#1             UC          0        0   bge0
home               00:14:95:c1:fd:d1  UHLW        2     4229   bge0   1200
chi                00:13:20:c1:d6:64  UHLW        1        9    lo0
192.168.1          link#2             UC          0        0   ath0
192.168.1.64       00:13:02:22:4c:11  UHLW        1     5717   ath0   1191