Код: Выделить всё
##Intefaces
wan_if="rl0"
serv_if="rl1"
loc_if="dc0"
##NETWORKS
loc_net="192.168.1.0/24"
serv_net="xx.xx.xx.0/25"
home="{ xx.xx.xx.xx, xx.xx.xx.xx, xx.xx.xx.xx }"
##IP ADDRESSES
squid="xx.xx.xx.xx"
my="xx.xx.xx.xx"
server="xx.xx.xx.xx"
ipod="xx.xx.xx.xx"
mail="xx.xx.xx.xx"
atc="xx.xx.xx.xx"
file_serv="xx.xx.xx.xx"
aster="xx.xx.xx.xx"
toktom="212.42.110.9"
dns_elcat="{ 212.42.96.1, 212.42.96.2}"
soc_found="195.38.189.197"
##PORTS
icmp_types="{ echoreq, unreach}"
aster_ports="{ 22, 5060, 50601}"
chat_ports="{ 443, 5190}"
atc_ports="{ 5103}"
mail_ports="{ 25, 143, 110, 465, 993, 587}"
vnc_ports="{ 5800, 5900}"
toktom_ports="{ 8167, 8168}"
#NAT
nat on $wan_if from $serv_net to any port $chat_ports -> $wan_if
nat on $wan_if from $squid to any -> $wan_if
nat on $wan_if from $mail to any port $mail_ports -> $mail
nat on $wan_if from $mail to any port www -> $mail
nat on $wan_if from $loc_net to any port $chat_ports -> $wan_if
nat on $wan_if from $loc_net to any port $mail_ports -> $wan_if
nat on $wan_if from $my to any -> $my
nat on $wan_if from $loc_net to $soc_found -> $wan_if
nat on $wan_if from $home to any -> $wan_if
nat on $wan_if from $loc_net to any -> $wan_if
nat on $wan_if from $atc to any -> $atc
nat on $serv_if from $serv_net to any -> $serv_if
set skip on lo0
block log all
antispoof log quick for { lo0, $wan_if, $serv_if }
block all
block drop in log quick on { $serv_if, $wan_if, $loc_if } proto tcp from any to any port smtp
block drop log quick from <BRUTEFORCERS>
#Local traffic
pass out on $loc_if from any to $loc_net
pass in on $loc_if from $loc_net to any
pass out on $serv_if from $loc_net to $serv_net
pass in on $serv_if from $serv_net to any
pass out on $wan_if from $wan_if to any
pass in on $serv_if from $loc_net to $serv_net
############################SERVERS################################
####################DNS
pass in on $serv_if proto { tcp, udp} to port 53 keep state
pass in on $wan_if proto { tcp, udp} to port 53 keep state
pass out on $serv_if proto { tcp, udp} to port 53 keep state
pass out on $wan_if proto { tcp, udp} to port 53 keep state
#Updates
pass out on $wan_if from any to $soc_found keep state
pass out on $wan_if from any to 65.55.182.108 keep state
pass out on $wan_if from any to 213.199.149.228 keep state
pass out on $wan_if from any to 213.199.149.229 keep state
pass out on $wan_if proto { tcp, udp} from $mail port $toktom_ports keep state
pass in on $wan_if proto { tcp, udp} from $toktom to any port $toktom_ports keep state
pass in on $wan_if from 195.38.189.197 to any keep state
#Asterisk
pass out on $wan_if proto { tcp, udp} from $aster to any port $aster_ports keep state
pass in on $wan_if proto { tcp, udp} from any to $aster port $aster_ports
#Squid
pass out on $wan_if from $squid to any keep state
#MAIL
pass in on $serv_if proto { tcp, udp} from any to $mail port $mail_ports keep state
pass in on $serv_if proto { tcp, udp} from any to $mail port www keep state
pass out on $serv_if proto { tcp, udp} from any to $mail port $mail_ports keep state
pass out on $serv_if proto { tcp, udp} from any to $mail port www keep state
pass in on $wan_if proto { tcp, udp} from any to $mail port $mail_ports keep state
pass in on $wan_if proto { tcp, udp} from any to $mail port www keep state
pass out on $wan_if proto { tcp, udp} from any to $mail port $mail_ports keep state
pass out on $wan_if proto { tcp, udp} from any to $mail port www keep state
#ICMP
pass in on $wan_if proto icmp from any to $wan_if icmp-type $icmp_types keep state
pass in on $wan_if proto icmp from any to $serv_if icmp-type $icmp_types keep state
############################ALL################################
#All in
pass in on $serv_if from any to $my keep state
pass in on $wan_if from any to $my keep state
pass in on $wan_if from any to $atc keep state
pass in on $wan_if from $home to any keep state
#All out
pass out on $serv_if from any to $my keep state
pass out on $wan_if from $my to any keep state
pass out on $wan_if from $atc to any keep state
pass out on $loc_if from any to any keep state
############################Users################################
#USERS IN
pass in on $wan_if proto { tcp, udp} from any to $loc_net port $chat_ports keep state
pass in on $wan_if proto { tcp, udp} from any to $loc_net port $mail_ports keep state
pass in on $wan_if from any to $loc_net keep state
#USERS OUT
pass out on $wan_if proto { tcp, udp} from $loc_net port $chat_ports to any keep state
pass out on $wan_if proto { tcp, udp} from $loc_net port $mail_ports to any keep state
pass out on $wan_if from $loc_net to any keep state
############################Home################################
#Home traffic in
pass in on $wan_if from $home to any keep state
pass in on $serv_if from $home to any keep state
#Home traffic out
pass out on $wan_if from any to $home keep state
pass out on $serv_if from any to $home keep state
