## macros ##

# Protocols
# 5201 is iperf3
# 27015 is CS 1.6
# 27006 27016 27020 is TF2
# 27007 27017 27021 is CS: GO
# 25565 is Minecraft
# 10048 to 19968 is RTP
tcp_in = "{ ssh 5201 }"
udp_in = "10048:19968"
icmp_in = "{ echoreq unreach }"
icmp6_in = "{ echoreq unreach timex paramprob routeradv routersol \
neighbradv neighbrsol }"
web_in = "{ http https }"
cs_in = "27015"
tf2_in = "{ 27006 27016 27020 }"
csgo_in = "{ 27007 27017 27021 }"
mc_in = "25565"
udp_self = "{ sip domain }"

# Interfaces
ext_if = "em0"
dmz_if = "vlan70"
int_if = "{ vlan10 vlan20 vlan30 vlan40 vlan50 vlan60 }"

# Networks
dmz_net = "vlan70:network"
int_net = "{ vlan10:network vlan20:network vlan30:network \
vlan40:network vlan50:network vlan60:network }"

# DMZ IPv4 hosts (only used for port-forwarding)
web_server = "10.15.89.254"
cs_server = "10.15.89.254"
tf2_server = "10.15.89.254"
csgo_server = "10.15.89.254"
mc_server = "10.15.89.254"
dmz_server = "10.15.89.254"

## default rule ##

# 01172021 - this is breaking shit; why??
#block all

## NAT rules ##

# IPv4 to web server
match in on $ext_if inet proto { tcp udp } to port $web_in rdr-to $web_server
# IPv4 to game servers
match in on $ext_if inet proto udp to port $cs_in rdr-to $cs_server
match in on $ext_if inet proto { udp tcp } to port $tf2_in rdr-to $tf2_server
match in on $ext_if inet proto { udp tcp } to port $csgo_in rdr-to $csgo_server
match in on $ext_if inet proto { tcp udp } to port $mc_in rdr-to $mc_server

# IPv4 from dmz network
match out on $ext_if inet from $dmz_net nat-to ($ext_if)

# IPv4 from internal network
match out on $ext_if inet from $int_net nat-to ($ext_if)

## input ##

# default
#block in all

# DMZ
# web server
pass in on $ext_if proto { tcp udp } to $dmz_net port $web_in
# game servers
pass in on $ext_if proto udp to $dmz_net port $cs_in
pass in on $ext_if proto { udp tcp } to $dmz_net port $tf2_in
pass in on $ext_if proto { udp tcp } to $dmz_net port $csgo_in
pass in on $ext_if proto { tcp udp } to $dmz_net port $mc_in

# Internal
pass in on $int_if to { $dmz_net $int_net }

# Self
# UDP
pass in proto { udp tcp } to self port $udp_self
# OSPF
#pass in proto ospf from { $dmz_net $int_net } to self

# Any
# TCP
pass in proto { tcp udp } to port $tcp_in keep state (max-src-conn-rate 10/60)
# FTP proxy, fix for getting thru NAT
anchor "ftp-proxy/*"
pass in quick inet proto tcp to port ftp divert-to 127.0.0.1 port 8021
# UDP
pass in proto { udp tcp } to port $udp_in keep state (max-src-conn-rate 10/60)
# fix for traceroute
pass in proto udp to port 33433:33626
# ICMP & ICMPv6
pass inet proto icmp icmp-type $icmp_in
pass inet6 proto icmp6 icmp6-type $icmp6_in

## output ##

# default
#block out all
# permit outbound
pass out on { $dmz_if $ext_if } from { $dmz_net $int_net }
pass out from self
# block dmz to int
block out from $dmz_net to $int_net

## queueing ##

# egress queue
queue outq on em0 flows 1024 bandwidth 30M max 30M qlimit 1024 default

# ingress queue
queue inq on aggr0 flows 1024 bandwidth 300M max 300M qlimit 1024 default