# remotevpn1
ext_if="bge1"
int_if="bge0"
trusted_net="10.0.0.0/8"
barracuda="10.3.100.11"

table <allowed_relay_hosts> persist file "/xxx/data/allowed_hosts.txt"

rdr on $ext_if inet proto tcp from <allowed_relay_hosts> to $ext_if port 25 -> $barracuda
no nat on $int_if inet proto tcp from $int_if to $trusted_net
nat on $int_if inet proto tcp from <allowed_relay_hosts> to $barracuda port 25 -> $int_if

block in on $ext_if all
block out on $ext_if all
block in on $int_if all
block out on $int_if all

# external interface rules
## customer rules
##
## VPN
pass in quick on $ext_if inet proto {tcp udp} from <allowed_relay_hosts> to $ext_if port 500 keep state
pass out quick on $ext_if inet proto {tcp udp} from $ext_if port 500 to <allowed_relay_hosts> keep state
## SMTP
pass in on $ext_if inet proto tcp from <allowed_relay_hosts> to $ext_if port 25 keep state
pass out on $ext_if inet proto tcp from $ext_if port 25 to <allowed_relay_hosts> keep state
##
#pass in on $ext_if inet proto tcp from

pass in quick on $ext_if inet proto tcp from any to $ext_if port 22 keep state
pass out quick on $ext_if inet proto tcp from $ext_if port 22 to any keep state

# internal interface rules
## ssh
pass in quick on $int_if inet proto tcp from any to $int_if port 22 keep state
pass out quick on $int_if inet proto tcp from $int_if port 22 to any keep state
## mysql
pass in quick on $int_if inet proto tcp from any to $int_if port 3306 keep state
pass out quick on $int_if inet proto tcp from $int_if port 3306 to any keep state
## smtp
pass out on $int_if inet proto tcp from $ext_if to $barracuda port 25 keep state

# overall rules.  icmp, dns, etc that all intefaces need to allow
pass out on $ext_if inet proto {tcp udp} from $ext_if to any port 53 keep state
pass out on $int_if inet proto {tcp udp} from $int_if to any port 53 keep state
pass out on $ext_if inet proto icmp from $ext_if to any keep state
pass out on $int_if inet proto icmp from $int_if to any keep state