# $OpenBSD: faq-example1,v 1.2 2003/08/06 16:04:45 henning Exp $

#
# Firewall for Home or Small Office
# http://www.openbsd.org/faq/pf/example1.html
#


# macros
int_if = "fxp0"
ext_if = "fxp1"

tcp_services = "{ 25, 80, 443, 444, 445, 22 }"
udp_services = "{ 1194 }"
#forbidden_ports_intif = "{ 25  }"
icmp_types = "echoreq"

priv_nets = "{ 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8 }"

# options
set block-policy return
set loginterface $ext_if

# scrub
scrub in all

# nat/rdr
#nat on $ext_if from $int_if to any -> 64.56.145.210/32
nat log on $ext_if from $int_if:network to any -> ($ext_if)
rdr on $int_if proto tcp from any to any port 80 -> 127.0.0.1 port 3128 #squid transparent proxy
rdr on $ext_if proto tcp from any to any port 3389 -> 10.0.0.100 port 3389 #hm backdoor, we control this with pf later
#rdr on $ext_if proto tcp from any to any port 993 -> 10.0.0.2 port 993 #imap over ssl to guardian01

# filter rules
block all

#allow everything from lo0 and tun0
pass quick on lo0 all
pass quick on tun0 all

#antispoof
block drop in  quick on $ext_if from $priv_nets to any
block drop out quick on $ext_if from any to $priv_nets
pass in inet proto icmp all icmp-type $icmp_types keep state #we also accept some icmp messages

#fxp0 inbound
pass in quick on $ext_if inet proto tcp from any to ($ext_if) \
   port $tcp_services flags S/SAFR keep state
pass in quick on $ext_if inet proto udp from any to ($ext_if) \
   port $udp_services keep state
#allow our vendors to remote into our computers using rdp/vnc
pass  in   quick on $ext_if proto tcp  from 66.46.110.252   to any port = 3389 keep state flags S/SAFR#hm
pass  in   quick on $ext_if proto tcp  from 208.38.57.81    to any port = 5900 keep state flags S/SAFR#canem
#if the previous two rdp rules didnt let them through, quickly block them
block in   quick on $ext_if proto tcp from any to any port 3389
block in   quick on $ext_if proto tcp from any to any port 5900
#if they made it all the way down here then we should probably block them
block in   quick on $ext_if  from any  to any

#fxp0 inbound
pass in  on $int_if from $int_if:network to any keep state flags S/SAFR #default pass rule
#block port 25 unless its 10.0.0.2
pass in quick on $int_if proto tcp  from 10.0.0.2  to any port = 25 keep state flags S/SAFR
#block return in quick on $int_if proto tcp  from any  to any port = 25

#a bunch of traffic we allow which we don't really need to since inbound rule says we allow it all anyway
pass  in     quick on $int_if proto tcp  from 10.0.0.2  to any port = 80 keep state flags S/SAFR
pass  in     quick on $int_if proto tcp  from 10.0.0.2  to any port = 443 keep state flags S/SAFR
pass  in     quick on $int_if proto tcp  from 10.0.0.2  to any port = 53 keep state flags S/SAFR
pass  in     quick on $int_if proto tcp  from 10.0.0.2  to any port = 13 keep state flags S/SAFR
pass  in     quick on $int_if proto udp  from 10.0.0.2  to any port = 53 keep state
pass  in     quick on $int_if proto udp  from 10.0.0.2  to any port = 123 keep state
pass  in     quick on $int_if proto tcp  from 10.0.0.100  to any port = 3101 keep state flags S/SAFR




#fxp0 outbound, we don't really marshal this at all so the default pass rule is fine
pass out on $int_if from any to $int_if:network keep state flags S/SAFR

#fxp1 outbound, again we don't really marshal this
#pass out on $ext_if proto tcp all modulate state flags S/SAFR
pass out on $ext_if proto tcp all keep state flags S/SAFR
pass out on $ext_if proto { udp, icmp } all keep state