set hostid 0xb8d56e4d
set state-policy floating
set state-defaults pflow
set limit table-entries 400000
set optimization normal
set limit states 805000
set limit src-nodes 805000

#System aliases
  
loopback = "{ lo0 }"
WAN = "{ ix3 }"
table <WAN__NETWORK> persist { 172.21.56.0/24 aa::/128 192.168.52.11/32 192.168.254.12/32 }
WAN__NETWORK = "<WAN__NETWORK>"
LAN = "{ igc0 }"
table <LAN__NETWORK> persist { 192.168.254.0/24 192.168.254.11/32 }
LAN__NETWORK = "<LAN__NETWORK>"
WAN2 = "{ ix2 }"
table <OPT1__NETWORK> persist { 192.168.72.0/30 }
OPT1__NETWORK = "<OPT1__NETWORK>"
WAN3 = "{ ix0 }"
WAN4 = "{ ix1 }"
LAN2 = "{ igc1 }"
table <OPT4__NETWORK> persist { 192.168.200.0/24 }
OPT4__NETWORK = "<OPT4__NETWORK>"
LAN4 = "{ igc3 }"
table <OPT5__NETWORK> persist { 172.16.4.0/24 }
OPT5__NETWORK = "<OPT5__NETWORK>"
VTI = "{ ipsec1 }"
table <OPT6__NETWORK> persist { 10.0.7.0/30 }
OPT6__NETWORK = "<OPT6__NETWORK>"
IPsec = "{ enc0 }"
OpenVPN = "{ openvpn }"
WireGuard = "{ WireGuard }"

#SSH Lockout Table
table <sshguard> persist
#Snort tables
table <snort2c>
table <virusprot>
table <bogons> persist file "/etc/bogons"
table <vpn_networks> { 10.0.7.2/32 192.168.100.2/32 }
table <negate_networks> { 10.0.7.2/32 192.168.100.2/32 }

# User Aliases 
table <BBbBB_PRI1_v4> persist
BBbBB_PRI1_v4 = "<BBbBB_PRI1_v4>"
table <fqdn_test> persist
fqdn_test = "<fqdn_test>"
 
# Gateways
GWWAN_DHCP6 = "  "
GWWAN_DHCP = " route-to ( ix3 172.21.56.129 ) "
GWOPT6_VTIV4 = "  "
GWtest_downed = "  "

 
set loginterface igc0

set skip on pfsync0
set keepcounters

# Ethernet rules


scrub from any to <vpn_networks>   fragment no reassemble
scrub from <vpn_networks> to any   fragment no reassemble
scrub on $WAN inet all    fragment reassemble
scrub on $WAN inet6 all    fragment reassemble
scrub on $LAN inet all    fragment reassemble
scrub on $LAN inet6 all    fragment reassemble
scrub on $WAN2 inet all    fragment reassemble
scrub on $WAN2 inet6 all    fragment reassemble
scrub on $WAN3 inet all    fragment reassemble
scrub on $WAN3 inet6 all    fragment reassemble
scrub on $WAN4 inet all    fragment reassemble
scrub on $WAN4 inet6 all    fragment reassemble
scrub on $LAN2 inet all    fragment reassemble
scrub on $LAN2 inet6 all    fragment reassemble
scrub on $LAN4 inet all    fragment reassemble
scrub on $LAN4 inet6 all    fragment reassemble
scrub on $VTI inet all    fragment reassemble
scrub on $VTI inet6 all    fragment reassemble


no nat proto carp
no rdr proto carp
nat-anchor "natearly/*"
nat-anchor "natrules/*"

binat on ix3 inet from 192.168.254.103 to any -> 172.21.56.156

# Outbound NAT rules (manual)
nat on $WAN inet from 172.16.4.0/24 to 172.27.7.9/32 -> 172.21.56.155/32  static-port

# Outbound NAT rules (automatic)

# Subnets to NAT 
table <tonatsubnets> { 127.0.0.0/8 ::1/128 192.168.254.0/24 192.168.72.0/30 192.168.200.0/24 172.16.4.0/24 192.168.253.0/24 10.0.7.2 192.168.100.2 }
nat on $WAN inet from <tonatsubnets> to any port 500 -> 172.21.56.155/32  static-port
nat on $WAN inet6 from <tonatsubnets> to any port 500 -> aa::/128  static-port
nat on $WAN inet from <tonatsubnets> to any -> 172.21.56.155/32 port 1024:65535 
nat on $WAN inet6 from <tonatsubnets> to any -> aa::/128 port 1024:65535 
# TFTP proxy
rdr-anchor "tftp-proxy/*"
# NAT Inbound Redirects
rdr on ix3 inet proto icmp from any to 192.168.52.11 -> 192.168.200.10
# Reflection redirect
rdr on { igc0 ix2 ix0 ix1 igc1 igc3 enc0 openvpn WireGuard } inet proto icmp from any to 192.168.52.11 -> 192.168.200.10

anchor "openvpn/*"
anchor "ipsec/*"
# block IPv4 link-local. Per RFC 3927, link local "MUST NOT" be forwarded by a routing device,
# and clients "MUST NOT" send such packets to a router. FreeBSD won't route 169.254./16, but
# route-to can override that, causing problems such as in redmine #2073
block in log quick from 169.254.0.0/16 to any ridentifier 1000000101 label "Block IPv4 link-local"
block in log quick from any to 169.254.0.0/16 ridentifier 1000000102 label "Block IPv4 link-local"
#---------------------------------------------------------------------------
# default deny rules
#---------------------------------------------------------------------------
block in log inet all ridentifier 1000000103 label "Default deny rule IPv4"
block out log inet all ridentifier 1000000104 label "Default deny rule IPv4"
block in log inet6 all ridentifier 1000000105 label "Default deny rule IPv6"
block out log inet6 all ridentifier 1000000106 label "Default deny rule IPv6"

# IPv6 ICMP is not auxiliary, it is required for operation
# See man icmp6(4)
# 1    unreach         Destination unreachable
# 2    toobig          Packet too big
# 128  echoreq         Echo service request
# 129  echorep         Echo service reply
# 133  routersol       Router solicitation
# 134  routeradv       Router advertisement
# 135  neighbrsol      Neighbor solicitation
# 136  neighbradv      Neighbor advertisement
pass  quick inet6 proto ipv6-icmp from any to any icmp6-type {1,2,135,136} ridentifier 1000000107 keep state

# Allow only bare essential icmpv6 packets (NS, NA, and RA, echoreq, echorep)
pass out  quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type {129,133,134,135,136} ridentifier 1000000108 keep state
pass out  quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type {129,133,134,135,136} ridentifier 1000000109 keep state
pass in  quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type {128,133,134,135,136} ridentifier 1000000110 keep state
pass in  quick inet6 proto ipv6-icmp from ff02::/16 to fe80::/10 icmp6-type {128,133,134,135,136} ridentifier 1000000111 keep state
pass in  quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type {128,133,134,135,136} ridentifier 1000000112 keep state
pass in  quick inet6 proto ipv6-icmp from :: to ff02::/16 icmp6-type {128,133,134,135,136} ridentifier 1000000113 keep state
# We use the mighty pf, we cannot be fooled.
block log quick inet proto { tcp, udp } from any port = 0 to any ridentifier 1000000114 label "Block traffic from port 0"
block log quick inet proto { tcp, udp } from any to any port = 0 ridentifier 1000000115 label "Block traffic to port 0"
block log quick inet6 proto { tcp, udp } from any port = 0 to any ridentifier 1000000116 label "Block traffic from port 0"
block log quick inet6 proto { tcp, udp } from any to any port = 0 ridentifier 1000000117 label "Block traffic to port 0"

# Snort package
block log quick from <snort2c> to any ridentifier 1000000118 label "Block snort2c hosts"
block log quick from any to <snort2c> ridentifier 1000000119 label "Block snort2c hosts"

# CARP rules
block in log quick proto carp from (self) to any ridentifier 1000000201
pass  quick proto carp ridentifier 1000000202 no state

# SSH lockout
block in log quick proto tcp from <sshguard> to (self) port 22 ridentifier 1000000301 label "sshguard"

# webConfigurator lockout
block in log quick proto tcp from <sshguard> to (self) port 443 ridentifier 1000000351 label "GUI Lockout"
block in log quick from <virusprot> to any ridentifier 1000000400 label "virusprot overload table"
# allow our DHCP client out to the WAN
pass in  quick on $WAN proto udp from any port = 67 to any port = 68 ridentifier 1000000461 label "allow dhcp replies in WAN"
pass out  quick on $WAN proto udp from any port = 68 to any port = 67 ridentifier 1000000462 label "allow dhcp client out WAN" 
# Not installing DHCP server firewall rules for WAN which is configured for DHCP.
antispoof log for $WAN ridentifier 1000001470
antispoof log for $LAN ridentifier 1000002520
# allow access to DHCP server on LAN
pass in  quick on $LAN proto udp from any port = 68 to 255.255.255.255 port = 67 ridentifier 1000002541 label "allow access to DHCP server"
pass in  quick on $LAN proto udp from any port = 68 to 192.168.254.10 port = 67 ridentifier 1000002542 label "allow access to DHCP server"
pass out  quick on $LAN proto udp from 192.168.254.10 port = 67 to any port = 68 ridentifier 1000002543 label "allow access to DHCP server"
antispoof log for $WAN2 ridentifier 1000003570
antispoof log for $LAN2 ridentifier 1000006720
# allow access to DHCP server on LAN2
pass in  quick on $LAN2 proto udp from any port = 68 to 255.255.255.255 port = 67 ridentifier 1000006741 label "allow access to DHCP server"
pass in  quick on $LAN2 proto udp from any port = 68 to 192.168.200.1 port = 67 ridentifier 1000006742 label "allow access to DHCP server"
pass out  quick on $LAN2 proto udp from 192.168.200.1 port = 67 to any port = 68 ridentifier 1000006743 label "allow access to DHCP server"
antispoof log for $LAN4 ridentifier 1000007770
# allow access to DHCP server on LAN4
pass in  quick on $LAN4 proto udp from any port = 68 to 255.255.255.255 port = 67 ridentifier 1000007791 label "allow access to DHCP server"
pass in  quick on $LAN4 proto udp from any port = 68 to 172.16.4.1 port = 67 ridentifier 1000007792 label "allow access to DHCP server"
pass out  quick on $LAN4 proto udp from 172.16.4.1 port = 67 to any port = 68 ridentifier 1000007793 label "allow access to DHCP server"
antispoof log for $VTI ridentifier 1000008820

# loopback
pass in  on $loopback inet all ridentifier 1000012011 label "pass IPv4 loopback"
pass out  on $loopback inet all ridentifier 1000012012 label "pass IPv4 loopback"
pass in  on $loopback inet6 all ridentifier 1000012013 label "pass IPv6 loopback"
pass out  on $loopback inet6 all ridentifier 1000012014 label "pass IPv6 loopback"
# let out anything from the firewall host itself and decrypted IPsec traffic
pass out  inet all keep state allow-opts ridentifier 1000012015 label "let out anything IPv4 from firewall host itself"
pass out  inet6 all keep state allow-opts ridentifier 1000012016 label "let out anything IPv6 from firewall host itself"

pass out  route-to ( ix3 172.21.56.129 ) from 172.21.56.155 to !172.21.56.0/24 ridentifier 1000012111 keep state allow-opts label "let out anything from firewall host itself"
pass out  route-to ( ix3 172.21.56.129 ) from 192.168.52.11 to !192.168.52.11/32 ridentifier 1000012112 keep state allow-opts label "let out anything from firewall host itself"
pass out  route-to ( ix3 172.21.56.129 ) from 192.168.254.12 to !192.168.254.12/32 ridentifier 1000012113 keep state allow-opts label "let out anything from firewall host itself"
pass out   from 10.0.7.1 to !10.0.7.0/30 ridentifier 1000012114 keep state allow-opts label "let out anything from firewall host itself"
pass out  on $IPsec all ridentifier 1000012411 ridentifier 1000012412 keep state  label "IPsec internal host to host"
# make sure the user cannot lock himself out of the webConfigurator or SSH
pass in  quick on igc0 proto tcp from any to (igc0) port { 443 80 22 } ridentifier 10001 keep state label "anti-lockout rule"
# NAT Reflection rules
pass in  inet tagged PFREFLECT ridentifier 1000012431 keep state label "NAT REFLECT: Allow traffic to localhost"

# User-defined rules follow

anchor "userrules/*"
block  in log  quick  on $IPsec inet from any to any ridentifier 1715283286 label "USER_RULE" label "id:1715283286"
pass  in  quick  on $OpenVPN inet from any to any ridentifier 1711980590 keep state ( pflow  ) label "USER_RULE: OpenVPN keccak_kmac_server wizard" label "id:1711980590"
pass  in  quick  on $OpenVPN inet from any to any ridentifier 1715609215 keep state ( pflow  ) label "USER_RULE: OpenVPN test_openvpn wizard" label "id:1715609215"
pass  in  quick  on $WAN reply-to ( ix3 172.21.56.129 ) inet from any to any ridentifier 1713526756 keep state ( pflow  ) label "USER_RULE" label "id:1713526756"
pass  in  quick  on $WAN reply-to ( ix3 172.21.56.129 ) inet proto udp  from any to 172.21.56.155 port 1194 ridentifier 1711980589 keep state ( pflow  ) label "USER_RULE: OpenVPN keccak_kmac_server wizard" label "id:1711980589"
pass  in  quick  on $WAN reply-to ( ix3 172.21.56.129 ) inet proto icmp  from any to 192.168.200.10 ridentifier 1713526917 keep state ( pflow  ) label "USER_RULE: NAT " label "id:1713526917"
pass  in  quick  on $WAN reply-to ( ix3 172.21.56.129 ) inet proto udp  from any to 172.21.56.155 port 1194 ridentifier 1715609214 keep state ( pflow  ) label "USER_RULE: OpenVPN test_openvpn wizard" label "id:1715609214"
pass  in  quick  on $LAN inet proto tcp  from any to $fqdn_test ridentifier 1715870999 flags S/SA keep state ( pflow  ) label "USER_RULE" label "id:1715870999"
pass  in  quick  on $LAN inet from $LAN__NETWORK to any ridentifier 0100000101 keep state ( pflow  ) label "USER_RULE: Default allow LAN to any rule" label "id:0100000101"
# source address is empty. label "USER_RULE: Default allow LAN IPv6 to any rule"
pass  in  quick  on $LAN2 inet from any to any ridentifier 1713527423 keep state ( pflow  ) label "USER_RULE" label "id:1713527423"
pass  in  quick  on $LAN4 inet from any to any ridentifier 1715253727 keep state ( pflow  ) label "USER_RULE" label "id:1715253727"
pass  in  quick  on $VTI reply-to ( ipsec1 10.0.7.2 ) inet proto icmp  from 10.0.8.2 to 10.0.7.1 icmp-type echoreq ridentifier 1715790828 keep state ( pflow  ) label "USER_RULE: Passed via EasyRule" label "id:1715790828"
# array key "opt9" does not exist for "" in array: {WAN LAN WAN2 WAN3 WAN4 LAN2 LAN4 VTI IPsec OpenVPN WireGuard } label "USER_RULE"

# VPN Rules
pass out    proto udp from (self) to 192.168.254.2 port = 500 ridentifier 1000112551 keep state label "IPsec: 192.168.254.2 - outbound isakmp"
pass in  on $LAN   proto udp from 192.168.254.2 to (self) port = 500 ridentifier 1000112552 keep state label "IPsec: 192.168.254.2 - inbound isakmp"
pass out    proto udp from (self) to 192.168.254.2 port = 4500 ridentifier 1000112553 keep state label "IPsec: 192.168.254.2 - outbound nat-t"
pass in  on $LAN   proto udp from 192.168.254.2 to (self) port = 4500 ridentifier 1000112554 keep state label "IPsec: 192.168.254.2 - inbound nat-t"
pass out    proto esp from (self) to 192.168.254.2 ridentifier 1000112555 keep state label "IPsec: 192.168.254.2 - outbound esp proto"
pass in  on $LAN   proto esp from 192.168.254.2 to (self) ridentifier 1000112556 keep state label "IPsec: 192.168.254.2 - inbound esp proto"
pass out   route-to ( ix3 172.21.56.129 )  proto udp from (self) to 1.1.1.1 port = 500 ridentifier 1000112567 keep state label "IPsec: 1.1.1.1 - outbound isakmp"
pass in  on $WAN  reply-to ( ix3 172.21.56.129 )  proto udp from 1.1.1.1 to (self) port = 500 ridentifier 1000112568 keep state label "IPsec: 1.1.1.1 - inbound isakmp"
pass out   route-to ( ix3 172.21.56.129 )  proto udp from (self) to 1.1.1.1 port = 4500 ridentifier 1000112569 keep state label "IPsec: 1.1.1.1 - outbound nat-t"
pass in  on $WAN  reply-to ( ix3 172.21.56.129 )  proto udp from 1.1.1.1 to (self) port = 4500 ridentifier 1000112570 keep state label "IPsec: 1.1.1.1 - inbound nat-t"
pass out   route-to ( ix3 172.21.56.129 )  proto esp from (self) to 1.1.1.1 ridentifier 1000112571 keep state label "IPsec: 1.1.1.1 - outbound esp proto"
pass in  on $WAN  reply-to ( ix3 172.21.56.129 )  proto esp from 1.1.1.1 to (self) ridentifier 1000112572 keep state label "IPsec: 1.1.1.1 - inbound esp proto"

anchor "tftp-proxy/*"

