#       $OpenBSD: pf.conf,v 1.34 2007/02/24 19:30:59 millert Exp $
#
# See pf.conf(5) and /usr/share/pf for syntax and examples.
# Remember to set net.inet.ip.forwarding=1 and/or net.inet6.ip6.forwarding=1
# in /etc/sysctl.conf if packets are to be forwarded between interfaces.

# facilitate debugging by not silently drop refused packets
# return a TCP RST or ICMP Unreachable packet
set block-policy return

rdr-anchor "hoststated/*"

# block spoofing for rfc1918 hosts (ie. don't allow those addresses on external interface)
table <private> const { 10/8, 172.16/12, 192.168/16 }
# a static table that can be used temporarly to block hosts
# use this command to add hosts to it: pfctl -t badhosts -Tadd 204.92.77.111
table <badhosts> persist
block log quick on em0 from { <private>, <badhosts> } to any 

table <koumbit> const { 209.44.112.0/24 }
# block spoofing of our addresses from outside
block in log quick on em0 inet from <koumbit> to any 
# we could also block people prentending to be this switch
#block in inet from 209.44.112.0/24 to any

# allow traffic with proper addresses through external interface
pass in on em0 from any to <koumbit>
pass out on em0 from <koumbit> to any

# don't filter internal interface
pass quick on em1
pass quick on vlan1
pass quick on vlan60 

# safety net for now
pass in quick all 
pass out quick all

# default block policy
block log all