#
# pf.conf rules
# Establish a block by default firewall, allow all outbound traffic, b ut only allow ports on the list inbound
#

# define the external interface
ext_if="vtnet0"

# Set options
# block-policy can be either drop or return
set block-policy drop

# Avoid doing anything with the lo0 loopback interface
set skip on lo0
scrub on $ext_if all reassemble tcp no-df random-id max-mss 1440
antispoof quick for ($ext_if)

# Set up tables for IP blocking
table <childrens> persist
table <chuugoku> persist file "/etc/pf/zones/cn.zone"
table <ru> persist file "/etc/pf/zones/ru.zone"
icmp_types = "echoreq"
icmp6_types = "ipv6-icmp"

# Define services we want to allow  out
tcp_services = "{ ftp-data, ftp, ntp, bootpc, domain, ssh, smtp, www, https, imap, imaps }"
udp_services = "{ bootpc, domain, ntp }"

# block by default
block all

# Block anything in the childrens table
block in quick proto tcp from <childrens> to any
block in quick proto tcp from <chuugoku> to any port { 80 22 25 }
block in quick proto tcp from <ru> to any port { 80 22 25 }

# pass out any traffic from the host
pass out proto tcp to any port $tcp_services keep state
pass proto udp to any port $udp_services keep state

 # Allow ssh connections in from the internet
pass in inet proto tcp to $ext_if port ssh flags S/SA keep state (max-src-conn 5, max-src-conn-rate 5/5, overload <childrens> flush global)

# Pass in http traffic from the internet
pass in inet proto tcp to $ext_if port 80 flags S/SA keep state (max-src-conn 5, max-src-conn-rate 5/5, overload <childrens> flush global)

# Allow selected icmp types
#pass in inet proto icmp all icmp-type $icmp_types keep state
# Allow pings out
pass out inet proto icmp all icmp-type $icmp_types keep state
# and for ipv6
#pass out inet6 proto icmpv6-icmp all icmp-type $icmp6_types keep state

