# define network interfaces
ext_if = "fxp0"
int_if0 = "fxp1"
int_if1 = "xl0"

# table that holds all firewall's own IP's
table <firewall> const { self }

# don't filter loopback
set skip on lo0

# Be nice and say "Connection refused" instead of saying nothing
# set this to 'drop' to be nasty and leave spammers connections sitting idle
set block-policy return

# scrub nasty packets
scrub in all

# ftp stuff
# leave the nat line even if you aren't using nat, docs say so.
nat-anchor "ftp-proxy/*"
rdr-anchor "ftp-proxy/*"
nat on $ext_if from !($ext_if) -> ($ext_if:0)
rdr pass on $int_if0 proto tcp from any to any port ftp -> 127.0.0.1 port 8021

# define network aliases
localnet =  $int_if0:network
securenet = $int_if1:network

# non routable addrsses
martians = "{ 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, \
              10.0.0.0/8, 169.254.0.0/16, 192.0.2.0/24, \
              0.0.0.0/8, 240.0.0.0/4 }"

# define service macros
tcp_services      = "{ ssh, smtp, domain, www, pop3, \
                       auth, pop3s, imap, imaps, imap3, http, https, \
                       6667, 6668, 2087, 26, 2082, 2095, ftp, ftp-data, sftp, ldap, ldaps
                    }"
udp_services      = "{ domain, ntp, ldap, ldaps }"
icmp_services     = "echoreq"

# start rules
# default policy to block all traffic
block all

# allow random FTP ports
pass in quick proto tcp from any to any port > 49151

# pass in quick is FOR DEBUGGING ONLY
#pass in quick all

# keep out non-routables
block drop in quick on $ext_if from $martians to any
block drop out quick on $ext_if from any to $martians

# activate spoofing protection on all interfaces
block in quick from urpf-failed

# let traffic from inside, reach the outside,
pass out quick inet proto tcp from any to any
pass out quick inet proto udp from any to any
# ftp
pass out proto tcp from 127.0.0.1 to any port 21

# let in SSH to all, we keep this as an explicit rule.. just in case ;)
pass in quick inet proto tcp from any to any port ssh


# pass in tcp_services
pass in inet proto tcp from any to any port $tcp_services synproxy state
pass in inet proto udp from any to any port $udp_services

# ping either direction
pass inet proto icmp all icmp-type $icmp_services

anchor "ftp-proxy/*"
antispoof for $ext_if
antispoof for $int_if0

# don't set this until we assign an ip to  int_if1
#antispoof for $int_if1