#------------------------------------------------------------------------
# Definitions
ExtIF = "hme0"                   # External interface
IntIF = "hme1"                   # Internal interface
PppIF = "tun0"                   # PPP interface
LoopIF = "lo0"                   # Loopback interface
IntSegment = "192.168.42.0/24"   # Safe Network
IntIP = "192.168.42.1"           # Router's Internal IP
ExtSegment = "192.168.52.0/24"   # Unsafe Network
ExtIP = "192.168.52.1"           # Router's External IP

NoRoute = "{ 127.0.0.0/8, 172.16.0.0/12, 10.0.0.0/8, 255.255.255.255/32 }" 
PppNoRoute = "{ 192.168.0.0/16 }"

ExtToRouteTCP = "{ ssh, domain }"
ExtToRouteUDP = "{ domain }"
ExtToIntTCP   = "{ ssh }"
#------------------------------------------------------------------------


#------------------------------------------------------------------------
# Clean up fragmented and abnormal packets
scrub in all
#------------------------------------------------------------------------


#------------------------------------------------------------------------
# Defaults -- block and log everything
block             out log on { $PppIF, $ExtIF }           all
block             in  log on { $PppIF, $ExtIF }           all
block return-rst  out log on { $PppIF, $ExtIF } proto tcp all
block return-rst  in  log on { $PppIF, $ExtIF } proto tcp all
block return-icmp out log on { $PppIF, $ExtIF } proto udp all
block return-icmp out log on { $PppIF, $ExtIF } proto udp all

# but don't let IPv6 traffic propagate
block in  quick inet6 all
block out quick inet6 all
#------------------------------------------------------------------------


#------------------------------------------------------------------------
# Leave loopback interfaces unmolested
pass in  quick on $LoopIF all
pass out quick on $LoopIF all
#------------------------------------------------------------------------


#------------------------------------------------------------------------
# Immediate blocks
# mess with nmap attacks
block in log quick on $PppIF inet proto tcp from any to any flags FUP/FUP
block in log quick on $PppIF inet proto tcp from any to any flags SF/SFRA
block in log quick on $PppIF inet proto tcp from any to any flags /SFRA

# don't allow spoofing of non-routable addresses
block in  log quick on { $PppIF, $ExtIF } from $NoRoute to any
block out log quick on { $PppIF, $ExtIF } from any to $NoRoute

# Don't allow spoofing of 192.168/16 over ppp
block in  log quick on $PppIF from $PppNoRoute to any
block out log quick on $PppIF from any to $PppNoRoute

# silently drop broadcasts from ppp
block in  quick on $PppIF from any to 255.255.255.255
#------------------------------------------------------------------------


#------------------------------------------------------------------------
# Don't allow spoofing of 192.168/16 on the ExtIF, but don't block
# immediately as my segments should still be allowed through

block out log on $ExtIF from any to $PppNoRoute
#------------------------------------------------------------------------


#------------------------------------------------------------------------
# PPP pass rules
# inbound pass rules
# don't allow any inbound traffic currently

# outbound pass rules
# currently we will pass anything out on ppp, this must be changed 
# eventually, but for now I'm not enumerating
pass  out on $PppIF inet proto tcp  all flags S/SA keep state
pass  out on $PppIF inet proto udp  all            keep state
pass  out on $PppIF inet proto icmp all            keep state
#------------------------------------------------------------------------


#------------------------------------------------------------------------
# External Segment pass rules
# first ensure 192.168/16 address can't be spoofed inbound
block in  log on $ExtIF from $PppNoRoute to any

# inbound pass rules
# pass all TCP traffic in as it need to get in to get to the PPP link
pass  in  on $ExtIF inet proto tcp  from $ExtSegment to any \
      flags S/SA keep state
pass  in  on $ExtIF inet proto udp  from $ExtSegment to any \
      keep state
pass  in  on $ExtIF inet proto icmp from $ExtSegment to any \
      keep state

# now make sure the traffic _not_ destined for PPP is not allowed 
# through by default
block in  log on $ExtIF from $ExtSegment to $IntSegment

# and finally allow ingress traffic to this host on services 
# specified above
pass  in  on $ExtIF inet proto tcp from $ExtSegment to $IntIP \
      port $ExtToRouteTCP flags S/SA keep state
pass  in  on $ExtIF inet proto udp from $ExtSegment to $IntIP \
      port $ExtToRouteUDP            keep state

# outbound pass rules, allow all traffic from internal to external
block out log on $ExtIF from $PppNoRoute to any
pass  out on $ExtIF inet proto tcp  from $IntSegment to $ExtSegment \
      flags S/SA keep state
pass  out on $ExtIF inet proto udp  from $IntSegment to $ExtSegment \
      keep state
pass  out on $ExtIF inet proto icmp from $IntSegment to $ExtSegment \
      keep state
#------------------------------------------------------------------------

#------------------------------------------------------------------------
# External to Internal pass rules -- internal interface
#
pass  in  on $ExtIF inet proto tcp from $ExtSegment to $IntSegment \
      port $ExtToIntTCP flags S/SA keep state
pass  out on $IntIF inet proto tcp from $ExtSegment to $IntSegment \
      port $ExtToIntTCP flags S/SA keep state

#------------------------------------------------------------------------
# Router machine pass rules
# inbound pass rules
#block in  on { $PppIF, $ExtIF, $IntIF } from any to { $IntIP, $ExtIP }
#pass  in  on { $IntIF } from $IntSegment to { $IntIP, $ExtIP }

# outbound pass rules
#block out on { $PppIF, $ExtIF } from { $IntIP, $ExtIP } to any
# and eventually we'll add pass rules here.

# crap...  I need to work on this stuff, but I'll do that later.
block out log on $PppIF from { $IntIP, $ExtIP } to any

#------------------------------------------------------------------------


#------------------------------------------------------------------------
# TEMPORARY:  block the win98 box on the internal interface so it stops
#             killing ppp all the time.
#pass  in quick on $IntIF inet proto tcp from 192.168.42.5 to $IntIP \
      port 22 flags S/SA keep state
#pass  in quick on $IntIF inet proto tcp from 192.168.42.5 to $IntIP \
      port domain flags S/SA keep state
#pass  in quick on $IntIF inet proto tcp from 192.168.42.5 to $ExtSegment \
      port 22 flags S/SA keep state
#pass  out      on $IntIF inet proto tcp from 192.168.42.5 to any \
      port 6667 flags S/SA keep state
#block in  log quick on $IntIF from 192.168.42.5 to any
#------------------------------------------------------------------------


