#	$OpenBSD: pf.conf,v 1.35 2008/02/29 17:04:55 reyk Exp $
#
# See pf.conf(5) and /usr/share/pf for syntax and examples.
# Remember to set net.inet.ip.forwarding=1 and/or net.inet6.ip6.forwarding=1
# in /etc/sysctl.conf if packets are to be forwarded between interfaces.

#Interfaces
ext_if          = "em0"
int_if          = "em1"
dmz_if          = "vlan2"
#dmz_if		= "em2"
#tunnel_if       = "gif0"
wifi_if	        = "vlan3"

#Tunnel
#tunnel_remote   = "216.66.80.90"
#tunnel_local    = "212.85.79.127"
#tunnel_remote6  = "2001:470:27:f53::1/64"
#tunnel_local6   = "2001:470:27:f53::2/64"

#Static hosts
deanna          = "{ 10.0.0.3 2001:470:dfee::3 2001:9b1:efa:9801::3 }"
audrid          = "{ 10.0.0.4 2001:470:dfee::4 2001:9b1:efa:9801::4 }"
chiara          = "{ 10.0.0.5 2001:470:dfee::5 2001:9b1:efa:9801::5 }"
yedrin		= "{ 10.0.0.6 2001:470:dfee::6 2001:9b1:efa:9801::6 }"
tilly           = "{ 10.0.0.7 2001:470:dfee::7 2001:9b1:efa:9801::7 }"
ezri            = "{ 10.128.0.1 2001:470:dfee:1::80:0:1 2001:9b1:efa:9802::1 }"
akiha		= "{ 10.128.0.2 2001:470:dfee:1::80:0:2 2001:9b1:efa:9802::2 }"
leeta           = "{ 10.128.0.4 2001:470:dfee:1::80:0:4 2001:9b1:efa:9802::4 }"
sw              = "{ 10.128.0.10 }"
ap		= "{ 10.128.0.11 }"
atlas_probe	= "{ 2001:470:dfee:1::81:0:1 2001:9b1:efa:9802::10:1}"

audrid_ipmi     = "{ 10.200.0.2 2001:470:dfee:1::c8:0:2 2001:9b1:efa:9802::2:1 }"

#Static dhcp hosts
jadzia          = "{ 10.129.0.1 }"
emony           = "{ 10.129.0.2 }"

ezri_xp         = "{ 10.130.0.26 }"

#Services, dmz
gw_dmz          = "{ 10.1.0.1 2001:470:dfee::1:0:1 2001:9b1:efa:9801::1 }"
ns_master       = "{ 10.1.0.2 2001:470:dfee::1:0:2 2001:9b1:efa:9801:1::2 }"
ns_slave        = "{ 10.1.0.3 2001:470:dfee::1:0:3 2001:9b1:efa:9801:1::3 }"
mail            = "{ 10.1.0.4 2001:470:dfee::1:0:4 2001:9b1:efa:9801:1::4 }"
www             = "{ 10.1.0.5 2001:470:dfee::1:0:5 2001:9b1:efa:9801:1::5 }"
shell           = "{ 10.1.0.7 2001:470:dfee::1:0:7 2001:9b1:efa:9801:1::7 }"
ntp             = "{ 10.1.0.8 2001:470:dfee::1:0:8 2001:9b1:efa:9801:1::8 }"
blog            = "{ 10.1.0.5 2001:470:dfee::1:0:a 2001:9b1:efa:9801:1::a }"
husfoto         = "{ 10.1.0.5 2001:470:dfee::1:0:b 2001:9b1:efa:9801:1::b }"
nagios          = "{ 10.1.0.5 2001:470:dfee::1:0:c 2001:9b1:efa:9801:1::c }"
backup          = "{ 10.1.0.13 2001:470:dfee::1:0:d 2001:9b1:efa:9801:1::d }"
print           = "{ 10.128.0.4 2001:470:dfee:1::80:0:4 2001:9b1:efa:9802::4 }"

#Services, internal
gw_int          = "{ 10.200.0.1 2001:470:dfee:1::c8:0:1 2001:9b1:efa:9802:1::1 }"

#Services, wifi
gw_wifi         = "{ 192.168.136.1 }"

#Port definitions
mail_ports      = "{ smtp 26 imaps sieve }"
www_ports       = "{ www https 81 8886 8887 8888 15432 }"
shell_ports     = "{ ssh 113 5223 8020:8030 }"
shell_internal_ports = "{ epmap netbios-ns netbios-dgm netbios-ssn microsoft-ds sunrpc nfsd 32765:32768 21 20 }"
ezri_ports      = "{ 3000:3010 7808 3389 }"
ntp_ports       = "{ ntp }"
blog_ports      = "{ www https }"
husfoto_ports   = "{  www https 5634 }"
nagios_ports    = "{ www https 5667 }"
backup_internal_ports = "{ ssh 135:139 445 }"
print_ports     = "{ 9100 }"

table <firewall> { self }
table <net> { ::/0, 0.0.0.0/0, !$int_if:network, !$dmz_if:network, !$wifi_if:network, !self }

#Configuration
set block-policy return
set loginterface $ext_if
set skip on lo

# Port build user does not need network
block return out log proto {tcp udp} user _pbuild

#Normalization
#match in all scrub ( no-df random-id reassemble tcp )
match in all scrub ( no-df random-id )

#NAT
match out on egress inet from !(egress:network) nat-to (egress:0)
#match out on $ext_if inet from $int_if:network nat-to ($ext_if:0)
#match out on $ext_if inet from $dmz_if:Network nat-to ($ext_if:0)

#Port forwarding
match in on $ext_if inet proto { tcp udp } from any to any port domain rdr-to $ns_master
match in on $ext_if inet proto tcp from any to any port $mail_ports rdr-to $mail
match in on $ext_if inet proto tcp from any to any port 995 rdr-to $mail port imaps
match in on $ext_if inet proto tcp from any to any port $www_ports rdr-to $www
match in on $ext_if inet proto tcp from any to any port $shell_ports rdr-to $shell
match in on $ext_if inet proto {tcp udp } from any to any port $ntp_ports rdr-to $ntp
match in on $ext_if inet proto { tcp udp } from any to any port $ezri_ports rdr-to $ezri
match in on $ext_if inet proto { tcp } from any to any port $blog_ports rdr-to $blog
match in on $ext_if inet proto { tcp } from any to any port $husfoto_ports rdr-to $husfoto
match in on $ext_if inet proto { tcp } from any to any port $nagios_ports rdr-to $nagios
match in on $ext_if inet proto tcp from any to any port 2222 rdr-to $jadzia port ssh
match in on $ext_if inet proto tcp from any to any port 2223 rdr-to $jadzia port 3389

match in on $ext_if inet proto tcp from any to any port 2224 rdr-to $ezri_xp port 3389
match in on $ext_if inet proto tcp from any to any port 6000 rdr-to $akiha port 80
match in on $ext_if inet proto tcp from any to any port 6001 rdr-to $akiha port 80
match in on $ext_if inet proto tcp from any to any port 6022 rdr-to $akiha port 22

match in on $int_if inet proto tcp from $int_if:network to $ext_if port 3008 rdr-to $ezri

match in on {$int_if, $dmz_if} inet proto tcp from any to $mail port 995 rdr-to $mail port imaps

#pass quick

#Default block
block log

pass out on  { $dmz_if, $int_if } keep state
pass in on $int_if from $int_if:network to <net> modulate state

pass quick on { $int_if $dmz_if } inet6 proto icmp6 from self to { ff02::1, ff02::2} icmp6-type { routeradv }

#Anti spoofing
#block in log quick from urpf-failed
#antispoof log quick for { $ext_if $int_if $dmz_if $tunnel_if  }

#Allow outgoing packets to pass
pass out on $ext_if keep state

#Allow ping 
pass inet proto icmp all icmp-type echoreq code 0 keep state

#Allow packter traversing ipv6 over ipv4 tunnel
# pass in on { $tunnel_if $ext_if } proto ipv6 from $tunnel_remote to $tunnel_local
# pass out on $tunnel_if modulate state

#Allow some ipv6-icmp
#pass in on { $tunnel_if $ext_if }  inet6 proto icmp6 all icmp6-type { echoreq, routeradv, neighbrsol, neighbradv } modulate state
#pass in on { $int_if $dmz_if $ext_if } inet6 proto icmp6 all icmp6-type { echoreq, echorep, neighbrsol, neighbradv, routersol } modulate state
pass  proto ipv6-icmp
#pass in on { $int_if $dmz_if } inet6 proto udp from any to ff02::1:2  port 547 modulate state

#Allow dhcpv6
pass in on { $ext_if } inet6 proto udp from any port 547 to self port 546

#Temporary specailty for nfs until ports are locked
#After reboot only the range 32765-32769 should be needed
#pass in on $int_if proto { tcp udp } from $ezri to $shell

#Allow incoming connections to dmz
pass in proto { tcp udp } from any to { $ns_master $ns_slave } port domain synproxy state
pass in proto tcp from any to $mail port $mail_ports modulate state
pass in proto tcp from any to $www port $www_ports synproxy state
pass in proto tcp from any to $shell port $shell_ports synproxy state
pass in proto { tcp udp } from any to $ntp port $ntp_ports synproxy state
pass in proto { tcp } from any to $blog port $blog_ports synproxy state
pass in proto { tcp } from any to $husfoto port $husfoto_ports synproxy state
pass in proto { tcp } from any to $nagios port $nagios_ports synproxy state
pass in proto { tcp } from $int_if:network to $tilly port { ssh 8083 } synproxy state

pass in on $int_if proto { tcp udp } from any to $backup port $backup_internal_ports synproxy state
pass in on { $dmz_if $int_if } proto tcp from any to $audrid port ssh synproxy state
#pass in proto tcp from any to $gw_int port ssh

#Allow from net to internal
pass in proto { tcp udp } from any to $ezri port $ezri_ports keep state
pass in proto { tcp } from any to { $jadzia $emony } port ssh keep state
pass in proto { tcp } from any to $jadzia port 3389 keep state
pass in proto { tcp } from any to $ezri_xp port 3389 keep state
pass in proto { tcp } from any to $akiha port 80 keep state
pass in proto { tcp } from any to $akiha port 22 keep state

#Allow outgoing connections from machines in dmz
pass in on $dmz_if from { $yedrin $shell $chiara $tilly } to <net> modulate state
pass in on $dmz_if from any to <net> modulate state
pass in on $dmz_if proto tcp from $mail to <net> port { 25 26 } modulate state

#Allow printing from dmz
pass on { $dmz_if $int_if } proto tcp from any to $print keep state

block on $wifi_if
pass out on $wifi_if from <net> keep state
pass in on $wifi_if from $wifi_if:network to <net> modulate state
pass out on $wifi_if from $ns_master keep state
pass in on $wifi_if proto { tcp, udp } from $wifi_if:network to $ns_master port domain modulate state
pass on $wifi_if inet proto icmp all icmp-type echoreq code 0 keep state
