# define network interfaces
ext_if = "fxp0"
int_if0 = "fxp1"
int_if1 = "xl0"

# table that holds all firewall's own IP's
table <firewall> const { self }

# don't filter loopback
set skip on lo0

# Be nice and say "Connection refused" instead of saying nothing
# set this to 'drop' to be nasty and leave spammers connections sitting idle
set block-policy return

# scrub nasty packets
scrub in all

# ftp stuff
# leave the nat line even if you aren't using nat, docs say so.
nat-anchor "ftp-proxy/*"
rdr-anchor "ftp-proxy/*"
nat on $ext_if from !($ext_if) -> ($ext_if:0)
rdr pass on $int_if0 proto tcp from any to any port ftp -> 127.0.0.1 port 8021

# define network aliases
localnet =  $int_if0:network
securenet = $int_if1:network

# non routable addrsses
martians = "{ 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, \
              10.0.0.0/8, 169.254.0.0/16, 192.0.2.0/24, \
              0.0.0.0/8, 240.0.0.0/4 }"

# define service macros
# these services need to be added/tested
# KVM over ip
# power switch and data switch
#
tcp_services      = "{ ssh, smtp, domain, www, pop3, 444, 2083, 2096,\
                       auth, pop3s, imap, imaps, imap3, http, https, 902,\
                       6667, 6668, 2087, 26, 2082, 2095, ftp, ftp-data, sftp, lda
p, ldaps
                    }"
udp_services      = "{ domain, ntp, ldap, ldaps }"
icmp_services     = "echoreq"

# start rules
# default policy to block all traffic
#block log all
block all

# pass in quick is FOR DEBUGGING ONLY
#pass in quick all

# allow random FTP ports
# all of our ftp servesr have to know to respond to PASV between 60000 and 65000
pass in quick log proto tcp from any to any port > 59999

# cyclone
pass in quick from any to 216.126.79.2
pass in quick from any to 216.126.79.104
pass in quick log from any to 216.126.79.105
pass in quick from any to 216.126.79.106
pass in quick from any to 216.126.79.107
# poller
pass in quick from any to 216.126.79.75
pass in quick from any to 216.126.79.77

# keep out non-routables
block drop in quick log on $ext_if from $martians to any
block drop out quick log on $ext_if from any to $martians

# activate spoofing protection on all interfaces
block in quick log from urpf-failed

# let traffic from inside, reach the outside,
pass out quick inet proto tcp from any to any
pass out quick inet proto udp from any to any
# ftp
pass out proto tcp from 127.0.0.1 to any port 21

# let in SSH to all, we keep this as an explicit rule.. just in case ;)
pass in quick inet proto tcp from any to any port ssh

# pass in tcp_services
pass in inet proto tcp from any to any port $tcp_services synproxy state
pass in inet proto udp from any to any port $udp_services

# ping either direction
pass inet proto icmp all icmp-type $icmp_services

anchor "ftp-proxy/*"
antispoof for $ext_if
antispoof for $int_if0

# don't set this until we assign an ip to  int_if1
#antispoof for $int_if1