# OBJECTIVES
#
# - Have an Ethernet LAN on 10.0.0.0/24
# - Have an 802.11bg LAN on 10.0.1.0/24
# - Unrestricted internet for 10.0.0.0/23
# - Provide all of the following services:
#   + Response to ping
#   + 22   -> 10.0.0.1:22 (SSH)
#   + 8080 -> 10.0.0.1:80 (WWW)



# USER-SERVICABLE PARTS
#   Options in the following section are subject to change
#   with reality. If something external to pf changes, you
#   should only have to touch this section.
############################################################

# Controls logging.
logopt  = "log"

# Interface/network specification
ext_if  = "xl0"             # external
elan_if = "rl0"             # ethernet
wlan_if = "ath0"            # wifi
lan_ifs = "{ rl0 ath0 }"    # all internal interfaces
lan_net = "{ 10.0.0.0/23 }" # whole network (e+w)

# SSH
ssh_ext_port = "1022"
ssh_srv = "10.0.0.1 port 22"

# HTTP
http_ext_port = "8888"
http_srv = "10.0.0.1 port 80"





############################################################
# Everything below this point is routing commands, e.g.
# nothing that is configured by the variables above.
############################################################





# GENERAL CONFIGURATION
#   Options that are not associated with overall network
#   traffic flow.
############################################################

# Keep loopback interfaces on the local machine free of pf
# overhead.
set skip on lo

# Keep logs of traffic on the external interface.
set loginterface $ext_if

# Don't drop as many connections.
set optimization conservative

# NAT
nat on $ext_if from $lan_net to any -> ($ext_if)
rdr on $ext_if proto tcp to port $ssh_ext_port -> $ssh_srv
rdr on $ext_if proto tcp to port $http_ext_port -> $http_srv

# INTERNAL AND OUTBOUND TRAFFIC
#   LAN-to-LAN and LAN-to-world traffic.
############################################################

# Allows all traffic on the LAN interfaces, so traffic is
# only stopped at $ext_if.
pass quick on $lan_ifs

# Allow all traffic to reach the outside world.
pass out quick on $ext_if keep state



# OUTSIDE WORLD TRAFFIC
#   Traffic coming in from the outside world.
############################################################

# Default block policy
block in on $ext_if

# Allow ICMP (pinging)
pass in on $ext_if proto icmp keep state

pass in on $ext_if inet proto tcp to $ssh_srv flags S/SA synproxy state
pass in on $ext_if inet proto tcp to $http_srv flags S/SA synproxy state