# Macros
iface="em0"
i6face="gif0"
icmp_types= "echoreq"
ipv6=tun1
# = HOSTS/RANGES =
box="72.20.5.130"
iprange="72.8.130.205/16"
iprange2="72.20.33.33/16"
iprange3="72.8.133.161/16"
# = EGGDROP/PSYBNC RANGES = 10000-25000
# = Shoutcast Ranges = 25000-25900
# = IRCd Ranges = 6666-7200
# = IPv6 Ranges =
extip6="2001:5c0:9a6b::1"
intip6="2001:5c0:9a6b::1"
intnet6="2001:5c0:9a6b::/64"
xs4all="2001:888:0:2::2"
set timeout { interval 10, frag 30 }
set timeout { tcp.first 120, tcp.opening 30, tcp.established 86400 }
set timeout { tcp.closing 900, tcp.finwait 45, tcp.closed 90 }
set timeout { udp.first 60, udp.single 30, udp.multiple 60 }
set timeout { icmp.first 20, icmp.error 10 }
set timeout { other.first 60, other.single 30, other.multiple 60 }
set timeout { adaptive.start 0, adaptive.end 0 }
set limit { states 10000, frags 5000 }
set block-policy drop
set state-policy if-bound
set require-order yes
set fingerprints "/etc/pf.os"
set loginterface $iface
set skip on lo0

# Normalizes packets and masks the OS's shortcomings such as SYN/FIN packets
# [scrub reassemble tcp](BID 10183) and sequence number approximation
# bugs (BID 7487)
scrub in all
pass quick on lo0 all
# Filtering: the implicit first two rules are
block in log all
#block out all
#Berkley PF's anti-spoof protection?
antispoof for $iface inet

############### Box #################
#icmp, ping etc
pass in on $iface inet proto icmp all icmp-type $icmp_types keep state
pass out on $iface proto { tcp, udp, icmp } all modulate state
block in log quick on $iface inet proto tcp from any to any flags FUP/FUP
# = BIND =
pass in on $iface inet proto { tcp, udp } from any to $box port 53 keep state
# = IDENT =
pass in on $iface inet proto tcp from any to $box port 113 keep state
# = SSH =
pass in log on $iface inet proto tcp from any to $box port ssh keep state
# = WWW =
pass in log on $iface inet proto tcp from any to $box port 80 keep state
# = SSL =
pass in log on $iface inet proto tcp from any to $box port 443 keep state
# = FTP =
pass in on $iface inet proto tcp from any to $box port 21 keep state
# = SMTP =
pass in on $iface inet proto tcp from any to $box port 25 keep state

#IPV6
#pass out log on $ipv6 inet6 proto tcp from $box to $xs4all port 6667 keep state
pass in log quick inet6 all
pass out log quick inet6 all
pass in on $i6face inet6 proto tcp from any to any keep state
### Eggdrop / PSYBNC
pass in on $iface inet proto { tcp, udp } from any to $box port 4100 >< 65535 keep state
pass in on $iface inet proto { tcp, udp } from any to $iprange port 4100 >< 65535 keep state
pass in on $iface inet proto { tcp, udp } from any to $iprange2 port 4100 >< 65535 keep state
pass in on $iface inet proto { tcp, udp } from any to $iprange3 port 4100 >< 65535 keep state

#####ONLY FOR TESTING########
#open everything on cidr_net#
#pass in on $box all        #

### ABUSE
block in log on $iface inet proto tcp from 124.120.35.175 to $box port 22