### MACRO DEFS  ###
EXT="xl0"
INT="dc0"
NAT_P="{ tcp, udp }"
#BADIPS="{ 172.16.0.0/12, 127.0.0.1/8, 0.0.0.0/8, 169.254.0.0/16, 224.0.0.0/3 }"
BADIPSX="{ 172.16.0.0/12, 127.0.0.1/8, 0.0.0.0/8, 169.254.0.0/16, 224.0.0.0/3, 10.0.0.0/8 }"
TCP_SERVICES="{ http, ftp, ssh }"
WEBSERVER="10.0.0.2"

### OPTIONS (SET) ###
set block-policy return
set loginterface $EXT

### SCRUB RULES ###
scrub in on $EXT all
#added oct 25 2005
#antispoof for $EXT
#antispoof for $INT

### NAT RULES ###
nat on $EXT from $INT:network to any -> ($EXT)
#rdr on $EXT inet proto tcp from any to any port 80 -> $WEBSERVER port 80
#added oct 25 2005
rdr on $EXT proto tcp from any to any port $TCP_SERVICES -> $WEBSERVER

#added oct 25 2005
antispoof for $EXT
antispoof for $INT

### FILTERING RULES ###
block log all

#permitting traffic on loop back
pass quick on lo0 all


#blocking badips from entering/exiting
block drop in log quick on $EXT from $BADIPSX to any
block drop out log quick on $EXT from any to $BADIPSX

#opening the required ports
pass in log quick on $EXT inet proto tcp from any to ($EXT) port $TCP_SERVICES flags S/SA keep state

#passing web server traffic through to OKIDATA by using synproxy im avoiding outsiders to handshake with OKIDATA
pass in log on $EXT inet proto tcp from any to $WEBSERVER port 80 flags S/SA synproxy state

#Allowing external FTP access?
pass out on $EXT inet proto tcp from $EXT to any port 21 flags S/AUPRFS modulate state