lo = lo0
int = dc1
ext = dc0
reserved = " { 0.0.0.0/8, 10.0.0.0/8, 20.20.20.0/24, 127.0.0.0/8,
169.254.0.0/16, 172.16.0.0/12, 192.0.2.0/24, 192.168.0.0/16,
224.0.0.0/3, 255.255.255.255 } "
table <blacklist-tabell> file "/etc/blacklistedips"
set block-policy drop
set optimization aggressive # Kan denna påverka det negativt?
scrub in on $ext all
altq on $ext priq bandwidth 16000Kb queue { def, high, low }
queue high priority 2
queue low priority 0
queue def priority 1 priq(default)
nat on $ext inet from ($int)/24 to any -> ($ext)
pass log quick on $ext proto { tcp, udp } from any to any port 7171 keep state queue high
pass log quick on $ext proto { tcp, udp } from any to any port 27015 keep state queue high
pass log quick on $ext proto { tcp, udp } from any to any port 27016 keep state queue high
pass log quick on $ext proto { tcp, udp } from any to any port 80 keep state queue low
pass log quick on $ext proto { tcp, udp } from any to any port 21 keep state queue low
pass quick on $lo all
antispoof for { $lo, $int, $ext }
pass quick on $int all
block in on $ext all
block out quick on $ext inet from ! ($ext) to any
block return in quick on $ext proto tcp from any to any port 113
pass in log quick on $int proto tcp from any to any port 22 flags S/SA keep state
pass in log quick on $int proto { tcp, udp } from any to any port 80
pass in log quick on $ext proto { tcp, udp } from any to any port 80
pass in quick on $ext proto { tcp, udp } from any to any port 53 flags S/SA keep state
block out quick on $int from any to <blacklist-tabell>
pass out on $ext proto tcp from $ext to any flags S/SA keep state queue (high)
pass in on $ext proto tcp from any to $ext flags S/SA keep state queue (high)
pass out on $ext proto {tcp, udp, icmp} all keep state