#
# $Id: pf.conf,v 1.25 2010-04-14 20:00:43 teemu Exp $
#

###############################################################################
# Macros
###############################################################################

if_int  = "re0"
if_ext1 = "em0"
if_ext2 = "em1"
if_ext3 = "em2"
all_ifs = "{" $if_int $if_ext1 $if_ext2 $if_ext3 "}"
ext_ifs = "{" $if_ext1 $if_ext2 $if_ext3 "}"

if_int_v4   = "10.0.0.1"
home_net_v4 = "10.0.0.0/24"
if_int_v6   = "3ffe:f00::1"
home_net_v6 = "3ffe:f00::/64"

core7 = "10.0.0.10"
ps3   = "10.0.0.13"

###############################################################################
# Tables
###############################################################################

# These tables will be populated by dhclient
#
# It would be nice to figure out how to not hardcode the if name to
# the table name. I am too lazy to try but you could.
#
table <gw_em0> persist {}
table <gw_em1> persist {}
table <gw_em2> persist {}

table <private_nets> const persist {   \
    127.0.0.0/8                        \
    10.0.0.0/8                         \
    172.16.0.0/12                      \
    192.168.0.0/16                     \
}

table <ssh_ok> const persist {         \
    192.168.42.42                      \
    192.168.52.0/24                    \
}

table <http_ok> const persist {        \
    192.168.42.42                      \
    192.168.52.0/24                    \
}

###############################################################################
# Options
###############################################################################

set skip on lo0
set block-policy return
set loginterface $if_ext1
set state-policy if-bound

###############################################################################
# Packet normalisation
###############################################################################

match in              all scrub (no-df)
match out on $ext_ifs all scrub (random-id)
match     on $ext_ifs all scrub (reassemble tcp)

###############################################################################
# Translation rules
###############################################################################

# FTP proxy states need to override the rules below, so it must be here!
anchor "ftp-proxy/*"

# NAT
#
# ps3 and core7 are 1:1 natted, the rest are behind a "normal" NAT
#
match     on $if_ext3 from $ps3         binat-to $if_ext3
match     on $if_ext2 from $core7       binat-to $if_ext2
match out on $if_ext1 from $home_net_v4 nat-to  ($if_ext1)

###############################################################################
# Filter rules
###############################################################################

##
## GENERAL
##

# Block and log everything by default
block log all

# Antispoofing on all interfaces
antispoof quick for $all_ifs

# Block private addresses on external interfaces
block drop in  quick on $ext_ifs from <private_nets>
block drop out quick on $ext_ifs to   <private_nets>

# Block IPv6 on external interfaces
block drop quick on $ext_ifs inet6 all

##
## INCOMING
##

##########
# if_int #
##########

# FTP proxy
pass in quick on $if_int proto tcp from $home_net_v4 to port ftp \
    rdr-to 127.0.0.1 port 8021

# ps3
pass in quick on $if_int from $ps3 to $if_int_v4
pass in quick on $if_int from $ps3 route-to ($if_ext3 <gw_em2>)

# core7
pass in quick on $if_int from $core7 to $if_int_v4
pass in quick on $if_int from $core7 route-to ($if_ext2 <gw_em1>)

# Other home network nodes
pass in quick on $if_int from $home_net_v4 to $if_int_v4
pass in quick on $if_int from $home_net_v4 route-to ($if_ext1 <gw_em0>)

# IPv6
pass in quick on $if_int from fe80::/16 to fe80::/16
pass in quick on $if_int from fe80::/16 to ff02::/16
pass in quick on $if_int from $home_net_v6 to $if_int_v6
pass in quick on $if_int from $home_net_v6 to ff02::/16

###########
# if_ext1 #
###########

# Pass in SSH from addresses listed in ssh_ok table
pass in quick on $if_ext1 proto tcp from <ssh_ok> to ($if_ext1) port ssh
 
# Pass in HTTP from addresses listed in http_ok table
pass in quick on $if_ext1 proto tcp from <http_ok> to ($if_ext1) port http
 
###################
# if_ext2 (core7) #
###################

# # CODMWF2
# pass in quick on $if_ext2 proto udp to $core7 port 1500
# pass in quick on $if_ext2 proto udp to $core7 port 3005
# pass in quick on $if_ext2 proto udp to $core7 port 3101
# pass in quick on $if_ext2 proto udp to $core7 port 28960
# pass in quick on $if_ext2 proto tcp to $core7 port 27015

#################
# if_ext3 (ps3) #
#################

# PlayStation Network
pass in quick on $if_ext3 proto udp to $ps3 port 3658

# NHL 10
#
# I know that a table would be nicer looking here, but there was
# a problem with that which I don't remember, look at openbsd mailing
# list archives for details..
#
pass in quick on $if_ext3 proto udp to $ps3 port 3659
pass in quick on $if_ext3 proto udp to $ps3 port 6000
pass in quick on $if_ext3 proto udp to $ps3 port 9820:9880
pass in quick on $if_ext3 proto tcp to $ps3 port 9980:9989
pass in quick on $if_ext3 proto tcp to $ps3 port 30350:30400
pass in quick on $if_ext3 proto tcp to $ps3 port 42100

##
## OUTGOING
##

##########
# if_int #
##########

# IPv4 from Internet to home network
pass out quick on $if_int to $ps3 received-on $if_ext3 \
    reply-to ($if_ext3 <gw_em2>)
pass out quick on $if_int to $core7 received-on $if_ext2 \
    reply-to ($if_ext2 <gw_em1>)
pass out quick on $if_int to $home_net_v4 received-on $if_ext1 \
    reply-to ($if_ext1 <gw_em0>)

# IPv4 from fw
pass out quick on $if_int to $home_net_v4

# IPv6
pass out quick on $if_int from fe80::/16 to fe80::/16
pass out quick on $if_int from fe80::/16 to ff02::/16
pass out quick on $if_int from $if_int_v6 to $home_net_v6
pass out quick on $if_int from $if_int_v6 to ff02::/16

###########
# if_ext1 #
###########

pass out quick on $if_ext1 inet from ($if_ext1) modulate state

###################
# if_ext2 (core7) #
###################

pass out quick on $if_ext2 inet from ($if_ext2) modulate state

#################
# if_ext3 (ps3) #
#################

pass out quick on $if_ext3 inet from ($if_ext3) modulate state
