#	$OpenBSD: pf.conf,v 1.31 2006/01/30 12:20:31 camield Exp $
#
# See pf.conf(5) and /usr/share/pf for syntax and examples.
# Remember to set net.inet.ip.forwarding=1 and/or net.inet6.ip6.forwarding=1
# in /etc/sysctl.conf if packets are to be forwarded between interfaces.

ext_if="le0"
int_if="hme1"

set optimization aggressive
set loginterface $ext_if
set block-policy drop

scrub in

#nat on $ext_if from !($ext_if) -> ($ext_if:0)
nat on le0 from hme2:network to any -> (le0) 

# Bit Torrent redirect/pass rule 
rdr pass on $ext_if proto tcp from any to any port 6881:6889 -> 192.168.12.11 
rdr pass on $ext_if proto udp from any to any port 6881 -> 192.168.12.11 port 6881

#same for freenet
rdr pass on $ext_if proto udp from any to any port 26997 -> 192.168.12.11

# shareaza redirect/pass rule
rdr pass on $ext_if proto tcp from any to any port 6346 -> 192.168.12.11 port 6346
rdr pass on $ext_if proto udp from any to any port 6346 -> 192.168.12.11 port 6346

# emule 
rdr pass on $ext_if proto tcp from any to any port 14147 -> 192.168.12.11 port 14147
rdr pass on $ext_if proto udp from any to any port 49617 -> 192.168.12.11 port 49617

# counterstrike server rdr/pass
rdr pass on $ext_if proto tcp from any to any port 27016 -> 192.168.12.11 port 27016
rdr pass on $ext_if proto udp from any to any port 27016 -> 192.168.12.11 port 27016
rdr pass on $ext_if proto tcp from any to any port 27015 -> 192.168.12.11 port 27015
rdr pass on $ext_if proto udp from any to any port 27015 -> 192.168.12.11 port 27015


#pass for webserver
pass in quick proto tcp to any port www keep state
pass in quick proto tcp to any port https keep state


### BLOCK ###

#Block cable modem broadcasts.
block in log quick on $ext_if from any to 255.255.255.255 

#default block rule
block in log on $ext_if from any to any

#block spoofs
antispoof log for { lo $int_if }

### OUT ###

# statefully allow traffic out
pass out keep state flags S/SA

#start to pass things. here's web
pass out on $ext_if proto tcp from any port http keep state

#dns out, keeping state
pass out on $ext_if proto udp from any port domain keep state

#here's ICMP, we keep the state to allow return pings
pass out on $ext_if proto icmp keep state

### IN ###
#pass in DNS
pass in on $ext_if proto udp to any port domain 

#pass in SSH
pass in on $ext_if proto tcp to ($ext_if) port ssh keep state

#pass in identd
pass in on $ext_if proto tcp to ($ext_if) port auth keep state

#pass to tor from myself
pass in on lo proto tcp to lo port 9050 keep state