# pf.conf for avvio.com.br
#
# By flambers <flambers@flambers.com>
# Fri Apr  4 11:19:06 BRT 2008

###
### Macros
###

# interfaces
ext_if = "xl0"
int_if = "bge0"

# ips
ext_ip = "200.160.74.107"
internal_lan = "10.0.0.0/24"

ssh_port = "2323"
allowed_ssh = "{ \
        10.0.0.10, \
        10.0.0.15, \
        10.0.0.113, \
    201.63.116.3, \
        10.0.0.0/24 \
}"

###
### Options, scrub, rdr and nat
###

# options
set skip on lo0
set block-policy drop

# scrub
scrub all

# nat for internal lan
nat log on $ext_if from $internal_lan to any -> $ext_ip

# ftp-proxy for internal lan
rdr on $int_if proto tcp from $internal_lan port ftp -> 127.0.0.1 port 8021

# nat and proxy
nat-anchor "ftp-proxy/*"
anchor "ftp-proxy/*"

###
### Filter rules
###

# spoofed address protection
antispoof log quick for { lo0, $int_if, $ext_if } inet

# default policy
block log all

# block nmap os
block in log quick from any os "NMAP OS"

# allow icmp for all
pass in  log quick on $int_if proto icmp from $internal_lan to any icmp-type echoreq keep state
pass out log quick inet proto icmp all

# allow access to fw from internal lan
pass log quick on $int_if proto { tcp, udp } from $internal_lan to $int_if keep state

# rules from internal lan
pass in  log on $int_if inet proto { tcp, udp } from $internal_lan to any keep state
pass out log on $int_if inet proto { tcp, udp } from any to $internal_lan keep state

# rules to fw ext_ip
pass out log on $int_if inet proto { tcp, udp } from $int_if to any keep state
pass out log on $ext_if inet proto { tcp, udp } from $ext_ip to any keep state