##############################
# General configuration for pf
##############################
set hostid 0xb8d56e4d
set state-policy floating
set limit table-entries 2000000
set optimization normal
set timeout {  tcp.tsdiff 10  }
set limit states 805000
set limit src-nodes 805000

##############################
# Aliases used by the firewall
##############################
# System-defined aliases for interfaces
loopback = "{ lo0 }"
WAN = "{ ix3 }"
table <WAN__NETWORK> persist { 172.21.56.0/25 172.21.56.9/32 172.21.56.11/32 }
WAN__NETWORK = "<WAN__NETWORK>"
LAN = "{ igc0 }"
table <LAN__NETWORK> persist { 192.168.254.0/24 2a07:7e84:1000:19a1::/64 192.168.254.11/32 }
LAN__NETWORK = "<LAN__NETWORK>"
WAN2 = "{ ix2 }"
table <OPT1__NETWORK> persist { 192.168.253.0/24 }
OPT1__NETWORK = "<OPT1__NETWORK>"
WAN3 = "{ ix0 }"
table <OPT2__NETWORK> persist {  }
OPT2__NETWORK = "<OPT2__NETWORK>"
WAN4 = "{ ix1 }"
table <OPT3__NETWORK> persist {  }
OPT3__NETWORK = "<OPT3__NETWORK>"
LAN2 = "{ igc1 }"
table <OPT4__NETWORK> persist { 192.168.2.0/24 }
OPT4__NETWORK = "<OPT4__NETWORK>"
OPT5 = "{ ovpns1 }"
table <OPT5__NETWORK> persist { 10.137.0.0/24 }
OPT5__NETWORK = "<OPT5__NETWORK>"
IPSEC_VTI_TEST = "{ ipsec1 }"
table <OPT6__NETWORK> persist { 10.13.3.4/30 }
OPT6__NETWORK = "<OPT6__NETWORK>"
OPT9 = "{ ix3.3011 }"
table <OPT9__NETWORK> persist { 192.168.30.0/24 }
OPT9__NETWORK = "<OPT9__NETWORK>"
IPsec = "{ enc0 }"
table <ENC0__NETWORK> persist {  }
ENC0__NETWORK = "<ENC0__NETWORK>"
OpenVPN = "{ openvpn }"
table <OPENVPN__NETWORK> persist {  }
OPENVPN__NETWORK = "<OPENVPN__NETWORK>"
WireGuard = "{ WireGuard }"
table <WIREGUARD__NETWORK> persist {  }
WIREGUARD__NETWORK = "<WIREGUARD__NETWORK>"
Tailscale = "{ Tailscale }"
table <TAILSCALE__NETWORK> persist {  }
TAILSCALE__NETWORK = "<TAILSCALE__NETWORK>"

# System-defined aliases available to the user
table <bogons> persist file "/etc/bogons"
bogons = "<bogons>"
table <bogons> persist file "/etc/bogons"
bogons = "<bogons>"
#SSH Lockout Table
table <sshguard> persist
#Snort tables
table <snort2c>
table <virusprot>
_nexus_vpn_port_ = "{   42451 }"
table <vpn_networks> { 10.13.3.6/32 10.137.0.0/24 }
table <negate_networks> { 10.13.3.6/32 10.137.0.0/24 }
table <_loopback4_> {   127.0.0.0/8 }
_loopback4_ = "<_loopback4_>"
table <_loopback6_> {   ::1/128 }
_loopback6_ = "<_loopback6_>"
table <_loopback46_> {    127.0.0.0/8   ::1/128 }
_loopback46_ = "<_loopback46_>"
table <_linklocal4_> {   169.254.0.0/16 }
_linklocal4_ = "<_linklocal4_>"
table <_linklocal6_> {   fe80::/10 }
_linklocal6_ = "<_linklocal6_>"
table <_linklocal46_> {    169.254.0.0/16   fe80::/10 }
_linklocal46_ = "<_linklocal46_>"
table <_private4_> {   10.0.0.0/8  172.16.0.0/12  192.168.0.0/16 }
_private4_ = "<_private4_>"
table <_private6_> {   fc00::/7 }
_private6_ = "<_private6_>"
table <_private46_> {    10.0.0.0/8  172.16.0.0/12  192.168.0.0/16   fc00::/7 }
_private46_ = "<_private46_>"
table <_multicast4_> {   224.0.0.0/4 }
_multicast4_ = "<_multicast4_>"
table <_multicast6_> {   ff00::/8 }
_multicast6_ = "<_multicast6_>"
table <_multicast46_> {    224.0.0.0/4   ff00::/8 }
_multicast46_ = "<_multicast46_>"
table <_reserved4_> {   0.0.0.0/8  10.0.0.0/8  100.64.0.0/10  127.0.0.0/8  169.254.0.0/16  172.16.0.0/12  192.0.0.0/24  192.0.2.0/24  192.88.99.0/24  192.168.0.0/16  198.18.0.0/15  198.51.100.0/24  203.0.113.0/24  224.0.0.0/4  240.0.0.0/4  255.255.255.255/32 }
_reserved4_ = "<_reserved4_>"
table <_reserved6_> {   ::1/128  ::/128  ::ffff:0:0/96  64:ff9b::/96  64:ff9b:1::/48  100::/64  2001::/23  2001:2::/48  2001:db8::/32  2002::/16  3fff::/20  5f00::/16  fc00::/7  fe80::/10  ff00::/8 }
_reserved6_ = "<_reserved6_>"
table <_reserved46_> {    0.0.0.0/8  10.0.0.0/8  100.64.0.0/10  127.0.0.0/8  169.254.0.0/16  172.16.0.0/12  192.0.0.0/24  192.0.2.0/24  192.88.99.0/24  192.168.0.0/16  198.18.0.0/15  198.51.100.0/24  203.0.113.0/24  224.0.0.0/4  240.0.0.0/4  255.255.255.255/32   ::1/128  ::/128  ::ffff:0:0/96  64:ff9b::/96  64:ff9b:1::/48  100::/64  2001::/23  2001:2::/48  2001:db8::/32  2002::/16  3fff::/20  5f00::/16  fc00::/7  fe80::/10  ff00::/8 }
_reserved46_ = "<_reserved46_>"
table <_nat64reserved_> {   64:ff9b::0/104  64:ff9b::a00:0/104  64:ff9b::6440:0/106  64:ff9b::7f00:0/104  64:ff9b::a9fe:0/112  64:ff9b::ac10:0/108  64:ff9b::c000:0/120  64:ff9b::c000:200/120  64:ff9b::c058:6300/120  64:ff9b::c0a8:0/112  64:ff9b::c612:0/111  64:ff9b::c633:6400/120  64:ff9b::cb00:7100/120  64:ff9b::e000:0/100  64:ff9b::f000:0/100  64:ff9b::ffff:ffff/128 }
_nat64reserved_ = "<_nat64reserved_>"

# User-defined aliases
table <network_alias_test> {   192.168.203.0/24 }
network_alias_test = "<network_alias_test>"
table <testtest> {   8.8.8.8 }
testtest = "<testtest>"
webports = "{   80  443 }"

# System gateways
GWWAN_DHCP = " route-to ( ix3 172.21.56.1 ) "
GWLANGW = " route-to ( igc0 192.168.254.100 ) "
GWIPSECVTI_VTIV4 = " route-to ( ovpns1 10.137.0.1 ) "
GWIPSEC_VTI_TEST_VTIV4 = " route-to ( ipsec1 10.13.3.6 ) "

##########################################
# Interfaces used with pf stats collection
##########################################
set loginterface igc0

#################################
# Interfaces without pf filtering
#################################
set skip on pfsync0

############################################
# Preserve rule counters across rule updates
############################################
set keepcounters

##########################################
# Required rules for traffic normalization
##########################################
scrub from any to <vpn_networks> max-mss 1300  fragment no reassemble
scrub from <vpn_networks> to any max-mss 1300  fragment no reassemble
scrub on $WAN inet all    fragment reassemble
scrub on $WAN inet6 all    fragment reassemble
scrub on $LAN inet all    fragment reassemble
scrub on $LAN inet6 all    fragment reassemble
scrub on $WAN2 inet all    fragment reassemble
scrub on $WAN2 inet6 all    fragment reassemble
scrub on $WAN3 inet all    fragment reassemble
scrub on $WAN3 inet6 all    fragment reassemble
scrub on $WAN4 inet all    fragment reassemble
scrub on $WAN4 inet6 all    fragment reassemble
scrub on $LAN2 inet all    fragment reassemble
scrub on $LAN2 inet6 all    fragment reassemble
scrub on $OPT5 inet all   max-mss 1348 fragment reassemble
scrub on $OPT5 inet6 all   max-mss 1328 fragment reassemble
scrub on $IPSEC_VTI_TEST inet all    fragment reassemble
scrub on $IPSEC_VTI_TEST inet6 all    fragment reassemble
scrub on $OPT9 inet all    fragment reassemble
scrub on $OPT9 inet6 all    fragment reassemble

#######################################
# Rules for Network Address Translation
#######################################
no nat proto carp
no rdr proto carp
nat-anchor "natearly/*"
nat-anchor "natrules/*"

# Outbound NAT rules (manual)
no nat on $WAN inet from 192.168.254.33/32 to any
nat on $WAN inet from 127.0.0.0/8 to any port 500 -> 172.21.56.51/32  static-port # Auto created rule for ISAKMP - localhost to WAN
nat on $WAN inet from 127.0.0.0/8 to any -> 172.21.56.51/32 port 1024:65535  # Auto created rule - localhost to WAN
# Missing interface 'opt7' for rule 'Auto created rule for ISAKMP - localhost to OPT7'
# Missing interface 'opt7' for rule 'Auto created rule - localhost to OPT7'
nat on $WAN inet6 from ::1/128 to any port 500 -> (ix3)  static-port # Auto created rule for ISAKMP - localhost to WAN
nat on $WAN inet6 from ::1/128 to any -> (ix3) port 1024:65535  # Auto created rule - localhost to WAN
# Missing interface 'opt7' for rule 'Auto created rule for ISAKMP - localhost to OPT7'
# Missing interface 'opt7' for rule 'Auto created rule - localhost to OPT7'
nat on $WAN inet from 192.168.254.0/24 to any port 500 -> 172.21.56.51/32  static-port # Auto created rule for ISAKMP - LAN to WAN
# Missing interface 'opt7' for rule 'Auto created rule for ISAKMP - LAN to OPT7'
# Missing interface 'opt7' for rule 'Auto created rule - LAN to OPT7'
nat on $WAN inet from 192.168.253.0/24 to any port 500 -> 172.21.56.51/32  static-port # Auto created rule for ISAKMP - WAN2 to WAN
nat on $WAN inet from 192.168.253.0/24 to any -> 172.21.56.51/32 port 1024:65535  # Auto created rule - WAN2 to WAN
# Missing interface 'opt7' for rule 'Auto created rule for ISAKMP - WAN2 to OPT7'
# Missing interface 'opt7' for rule 'Auto created rule - WAN2 to OPT7'
nat on $WAN inet from 192.168.2.0/24 to any port 500 -> 172.21.56.51/32  static-port # Auto created rule for ISAKMP - LAN2 to WAN
nat on $WAN inet from 192.168.2.0/24 to any -> 172.21.56.51/32  static-port # Auto created rule - LAN2 to WAN
# Missing interface 'opt7' for rule 'Auto created rule for ISAKMP - LAN2 to OPT7'
# Missing interface 'opt7' for rule 'Auto created rule - LAN2 to OPT7'
nat on $WAN inet from 10.130.0.0/24 to any port 500 -> 172.21.56.51/32  static-port # Auto created rule for ISAKMP - OpenVPN server to WAN
nat on $WAN inet from 10.130.0.0/24 to any -> 172.21.56.51/32 port 1024:65535  # Auto created rule - OpenVPN server to WAN
# Missing interface 'opt7' for rule 'Auto created rule for ISAKMP - OpenVPN server to OPT7'
# Missing interface 'opt7' for rule 'Auto created rule - OpenVPN server to OPT7'
nat on $WAN inet from 10.130.255.5/24 to any port 500 -> 172.21.56.51/32  static-port # Auto created rule for ISAKMP - OpenVPN CSO to WAN
nat on $WAN inet from 10.130.255.5/24 to any -> 172.21.56.51/32 port 1024:65535  # Auto created rule - OpenVPN CSO to WAN
# Missing interface 'opt7' for rule 'Auto created rule for ISAKMP - OpenVPN CSO to OPT7'
# Missing interface 'opt7' for rule 'Auto created rule - OpenVPN CSO to OPT7'
nat on $WAN inet from 10.130.0.5/24 to any port 500 -> 172.21.56.51/32  static-port # Auto created rule for ISAKMP - OpenVPN CSO to WAN
nat on $WAN inet from 10.130.0.5/24 to any -> 172.21.56.51/32 port 1024:65535  # Auto created rule - OpenVPN CSO to WAN
# Missing interface 'opt7' for rule 'Auto created rule for ISAKMP - OpenVPN CSO to OPT7'
# Missing interface 'opt7' for rule 'Auto created rule - OpenVPN CSO to OPT7'
nat on $WAN inet from $LAN__NETWORK to any -> 172.21.56.9/32 port 1024:65535

# Outbound NAT rules (automatic)
# Subnets to NAT
table <tonatsubnets> { 127.0.0.0/8 ::1/128 10.136.0.0/32 192.168.203.0/24 192.168.254.0/24 192.168.253.0/24 192.168.2.0/24 192.168.30.0/24 10.137.0.0/24 10.130.255.5/24 10.130.0.5/24 10.13.3.6 }
nat on $WAN inet from <tonatsubnets> to any port 500 -> 172.21.56.51/32  static-port
nat on $WAN inet6 from <tonatsubnets> to any port 500 -> (ix3)  static-port
nat on $WAN inet from <tonatsubnets> to any -> 172.21.56.51/32 port 1024:65535
nat on $WAN inet6 from <tonatsubnets> to any -> (ix3) port 1024:65535

# NAT rules for the TFTP Proxy service
rdr-anchor "tftp-proxy/*"

#################################
# Extra rules from OpenVPN RADIUS
#################################
anchor "openvpn/*"

###############################
# Extra rules from IPsec RADIUS
###############################
anchor "ipsec/*"

#################
# Rules for Nexus
#################
pass quick on controltun0 keep state (if-bound) ridentifier 1000000011 label "descr=Netgate Nexus"

#################################
# Rules to block all IPv6 packets
#################################
# Allow IPv6 on loopback
pass in  quick on $loopback inet6 all ridentifier 1000000012 label "descr=pass IPv6 loopback"
pass out  quick on $loopback inet6 all ridentifier 1000000013 label "descr=pass IPv6 loopback"
# Block all IPv6
block in  quick inet6 all ridentifier 1000000014 label "descr=Block all IPv6"
block out  quick inet6 all ridentifier 1000000015 label "descr=Block all IPv6"

################################################################
# Rules to block NAT64 translation for non-global IPv4 addresses
################################################################
block in  quick inet6 from any to <_nat64reserved_> ridentifier 1000000016 label "descr=Block NAT64 for non-global IPv4"
block out  quick inet6 from any to <_nat64reserved_> ridentifier 1000000017 label "descr=Block NAT64 for non-global IPv4"

########################################
# Rules to block IPv4 link-local packets
########################################
# Block IPv4 link-local. Per RFC 3927, link local "MUST NOT" be forwarded by
# a routing device, and clients "MUST NOT" send such packets to a router.
# FreeBSD won't route 169.254./16, but route-to can override that, causing
# problems such as in redmine #2073
block in log quick from 169.254.0.0/16 to any ridentifier 1000000111 label "descr=Block IPv4 link-local"
block in log quick from any to 169.254.0.0/16 ridentifier 1000000112 label "descr=Block IPv4 link-local"

#####################################################
# Required rules for the default-deny filter behavior
#####################################################
block in  inet all ridentifier 1000000113 label "descr=Default deny rule IPv4" label "tags=ruleset:9b232dbde823c279"
block out  inet all ridentifier 1000000114 label "descr=Default deny rule IPv4" label "tags=ruleset:9b232dbde823c279"
block in  inet6 all ridentifier 1000000115 label "descr=Default deny rule IPv6" label "tags=ruleset:9b232dbde823c279"
block out  inet6 all ridentifier 1000000116 label "descr=Default deny rule IPv6" label "tags=ruleset:9b232dbde823c279"

#########################################
# Rules to drop invalid packets on port 0
#########################################
# We use the mighty pf, we cannot be fooled.
block  quick inet proto { tcp, udp } from any port = 0 to any ridentifier 1000000117 label "descr=Block traffic from port 0"
block  quick inet proto { tcp, udp } from any to any port = 0 ridentifier 1000000118 label "descr=Block traffic to port 0"

################################################
# Rules to block packets matched by IDS packages
################################################
block log quick from <snort2c> to any ridentifier 1000000119 label "descr=Block snort2c hosts"
block log quick from any to <snort2c> ridentifier 1000000120 label "descr=Block snort2c hosts"

#######################################
# Required rules for CARP functionality
#######################################
# CARP rules
block in  quick proto carp from (self) to any ridentifier 1000000211 label "descr=CARP operation"
pass  quick proto carp no state ridentifier 1000000212 label "descr=CARP operation"

#######################################################
# Rules for blocklisted hosts accessing the SSH service
#######################################################
block in  quick proto tcp from <sshguard> to (self) port 22 ridentifier 1000000311 label "descr=sshguard"

##################################################
# Rules for blocklisted hosts accessing the WebGUI
##################################################
block in  quick proto tcp from <sshguard> to (self) port 443 ridentifier 1000000361 label "descr=GUI Lockout"

#######################################################
# Rules to block packets matched by anti-virus packages
#######################################################
block in  quick from <virusprot> to any ridentifier 1000000400 label "descr=virusprot overload table"

#################################################
# Rules to prevent DHCP leaks in multi-WAN setups
#################################################
block out quick proto udp from any port = 67 to any port = 68 tagged "dhcpin" ridentifier 1000000461 label "descr=Prevent routing dhcp responses"

#########################
# Default interface rules
#########################
# allow our DHCP client out to the WAN
pass in  quick on $WAN proto udp from any port = 67 to any port = 68 tag "dhcpin" no state ridentifier 1000000471 label "descr=allow dhcp replies in WAN"
pass out  quick on $WAN proto udp from any port = 68 to any port = 67 no state ridentifier 1000000472 label "descr=allow dhcp client out WAN" 
# Not installing DHCP server firewall rules for WAN which is configured for DHCP.

# Required rules for antispoof protection
antispoof  for $WAN ridentifier 1000001481 label "descr=antispoof protection"

# Required rules for antispoof protection
antispoof  for $LAN ridentifier 1000002531 label "descr=antispoof protection"

# allow access to DHCP server on LAN
pass in  quick on $LAN proto udp from any port = 68 to 255.255.255.255 port = 67 ridentifier 1000002551 label "descr=allow access to DHCP server"
pass in  quick on $LAN proto udp from any port = 68 to 192.168.254.10 port = 67 ridentifier 1000002552 label "descr=allow access to DHCP server"
pass out  quick on $LAN proto udp from 192.168.254.10 port = 67 to any port = 68 ridentifier 1000002553 label "descr=allow access to DHCP server"

# allow access to DHCPv6 server on LAN
pass  quick on $LAN inet6 proto udp from fe80::/10 to fe80::/10 port = 546 ridentifier 1000002561 label "descr=allow access to DHCPv6 server"
pass  quick on $LAN inet6 proto udp from fe80::/10 to ff02::/16 port = 546 ridentifier 1000002562 label "descr=allow access to DHCPv6 server"
pass  quick on $LAN inet6 proto udp from fe80::/10 to ff02::/16 port = 547 ridentifier 1000002563 label "descr=allow access to DHCPv6 server"
pass  quick on $LAN inet6 proto udp from ff02::/16 to fe80::/10 port = 547 ridentifier 1000002564 label "descr=allow access to DHCPv6 server"
pass in  quick on $LAN inet6 proto udp from fe80::/10 to 2a07:7e84:1000:19a1:8ac9:b3ff:feb6:1639 port = 546 ridentifier 1000002565 label "descr=allow access to DHCPv6 server"
pass out  quick on $LAN inet6 proto udp from 2a07:7e84:1000:19a1:8ac9:b3ff:feb6:1639 port = 547 to fe80::/10 ridentifier 1000002566 label "descr=allow access to DHCPv6 server"

# Required rules for antispoof protection
antispoof  for $WAN2 ridentifier 1000003581 label "descr=antispoof protection"

# Required rules for antispoof protection
antispoof  for $LAN2 ridentifier 1000006731 label "descr=antispoof protection"

# allow access to DHCP server on LAN2
pass in  quick on $LAN2 proto udp from any port = 68 to 255.255.255.255 port = 67 ridentifier 1000006751 label "descr=allow access to DHCP server"
pass in  quick on $LAN2 proto udp from any port = 68 to 192.168.2.1 port = 67 ridentifier 1000006752 label "descr=allow access to DHCP server"
pass out  quick on $LAN2 proto udp from 192.168.2.1 port = 67 to any port = 68 ridentifier 1000006753 label "descr=allow access to DHCP server"

# Required rules for antispoof protection
antispoof  for $OPT5 ridentifier 1000007781 label "descr=antispoof protection"

# Required rules for antispoof protection
antispoof  for $IPSEC_VTI_TEST ridentifier 1000008831 label "descr=antispoof protection"

# Required rules for antispoof protection
antispoof  for $OPT9 ridentifier 1000009881 label "descr=antispoof protection"

#####################################
# Required rules for loopback traffic
#####################################
pass in  on $loopback inet all ridentifier 1000014121 label "descr=pass IPv4 loopback"
pass out  on $loopback inet all ridentifier 1000014122 label "descr=pass IPv4 loopback"

##########################################################
# Required rules for traffic from the firewall host itself
##########################################################
pass out  inet all keep state allow-opts ridentifier 1000014123 label "descr=let out anything IPv4 from firewall host itself"
pass out  route-to ( ix3 172.21.56.1 ) from 172.21.56.51 to !172.21.56.0/25 ridentifier 1000014221 keep state allow-opts  label "descr=let out anything from firewall host itself"
pass out  route-to ( ix3 172.21.56.1 ) from 172.21.56.11 to !172.21.56.0/25 ridentifier 1000014222 keep state allow-opts  label "descr=let out anything from firewall host itself"
pass out  route-to ( ovpns1 10.137.0.1 ) from 10.137.0.1 to !10.137.0.0/24 ridentifier 1000014223 keep state allow-opts  label "descr=let out anything from firewall host itself"
pass out   from 10.13.3.7 to !10.13.3.4/30 ridentifier 1000014224 keep state allow-opts  label "descr=let out anything from firewall host itself"

############################################
# Required rules for IPsec host connectivity
############################################
pass out  on $IPsec all ridentifier 1000014521 ridentifier 1000014522 keep state  label "descr=IPsec internal host to host"

#######################
# Anchor for user rules
#######################
anchor "userrules/*"

################################################
# User rules for system-defined interface groups
################################################
# Rules for IPsec
pass  in  quick  on $IPsec inet from any to any ridentifier 1780507862 keep state label "id=1780507862" label "tags=user_rule"

# Rules for OpenVPN
pass  in  quick  on $OpenVPN inet from any to any ridentifier 1746703765 keep state label "id=1746703765" label "tags=user_rule"

#####################################
# Interface rules defined by the user
#####################################
# Rules for WAN
pass  in  quick  on $WAN reply-to ( ix3 172.21.56.1 ) inet from any to any ridentifier 1751631963 keep state label "id=1751631963" label "tags=user_rule" label "descr=Allow all ipv4+ipv6 via pfSsh.php"
pass  in  quick  on $WAN inet6 from any to any ridentifier 1751631963 keep state label "id=1751631963" label "tags=user_rule" label "descr=Allow all ipv4+ipv6 via pfSsh.php"

# Rules for LAN
pass  in  quick  on $LAN inet from $LAN__NETWORK to any ridentifier 0100000101 keep state label "id=0100000101" label "tags=user_rule" label "descr=Default allow LAN to any rule"
pass  in  quick  on $LAN inet6 from $LAN__NETWORK to any ridentifier 0100000102 keep state label "id=0100000102" label "tags=user_rule" label "descr=Default allow LAN IPv6 to any rule"

# Rules for LAN2
pass  in  quick  on $LAN2 inet from any to any ridentifier 1746440189 keep state label "id=1746440189" label "tags=user_rule"

# Rules for OPT9
pass  in  quick  on $OPT9 inet from any to any ridentifier 1769615787 keep state label "id=1769615787" label "tags=user_rule"

#############################
# Rules for the IPsec service
#############################
pass out    proto udp from (self) to 172.21.56.1 port = 500 ridentifier 1000114661 keep state  label "descr=IPsec: 172.21.56.1 - outbound isakmp"
pass in  on $WAN   proto udp from 172.21.56.1 to (self) port = 500 ridentifier 1000114662 keep state label "descr=IPsec: 172.21.56.1 - inbound isakmp"
pass out    proto udp from (self) to 172.21.56.1 port = 4500 ridentifier 1000114663 keep state  label "descr=IPsec: 172.21.56.1 - outbound nat-t"
pass in  on $WAN   proto udp from 172.21.56.1 to (self) port = 4500 ridentifier 1000114664 keep state label "descr=IPsec: 172.21.56.1 - inbound nat-t"
pass out    proto esp from (self) to 172.21.56.1 ridentifier 1000114665 keep state  label "descr=IPsec: 172.21.56.1 - outbound esp proto"
pass in  on $WAN   proto esp from 172.21.56.1 to (self) ridentifier 1000114666 keep state label "descr=IPsec: 172.21.56.1 - inbound esp proto"

##################################
# Rules for the TFTP Proxy service
##################################
anchor "tftp-proxy/*"
