# pfctl -sr | more

scrub all random-id max-mss 1452 fragment reassemble
anchor "ftpsesame/*" all
anchor "firewallrules" all
block drop quick proto tcp from any port = 0 to any
block drop quick proto tcp from any to any port = 0
block drop quick proto udp from any port = 0 to any
block drop quick proto udp from any to any port = 0
block drop quick from <snort2c> to any label "Block snort2c hosts"
block drop quick from any to <snort2c> label "Block snort2c hosts"
block drop in quick inet6 all
block drop out quick inet6 all
anchor "loopback" all
pass in quick on lo0 all flags S/SA keep state label "pass loopback"
pass out quick on lo0 all flags S/SA keep state label "pass loopback"
anchor "packageearly" all
anchor "carp" all
anchor "dhcpserverlan" all
pass in quick on xl1 inet proto udp from any port = bootpc to 255.255.255.255 port = bootps keep state label "allow access to DHCP server on LAN"
pass in quick on xl1 inet proto udp from any port = bootpc to 10.0.0.1 port = bootps keep state label "allow access to DHCP server on LAN"
pass out quick on xl1 inet proto udp from 10.0.0.1 port = bootps to any port = bootpc keep state label "allow access to DHCP server on LAN"
block drop in log quick on xl0 inet proto udp from any port = bootps to 10.0.0.0/24 port = bootpc label "block dhcp client out wan"
block drop in log quick on ng0 inet proto udp from any port = bootps to 10.0.0.0/24 port = bootpc label "block dhcp client out wan"
block drop in on ! xl1 inet from 10.0.0.0/24 to any
block drop in inet from 10.0.0.1 to any
block drop in on xl1 inet6 from fe80::260:8cff:fef1:879e to any
anchor "spoofing" all
anchor "spoofing" all
block drop in on xl0 inet6 from fe80::260:8cff:fef1:8800 to any
block drop in log quick on xl0 inet from 10.0.0.0/8 to any label "block private networks from wan block 10/8"
block drop in log quick on ng0 inet from 10.0.0.0/8 to any label "block private networks from wan block 10/8"
block drop in log quick on xl0 inet from 127.0.0.0/8 to any label "block private networks from wan block 127/8"
block drop in log quick on ng0 inet from 127.0.0.0/8 to any label "block private networks from wan block 127/8"
block drop in log quick on xl0 inet from 172.16.0.0/12 to any label "block private networks from wan block 172.16/12"
block drop in log quick on ng0 inet from 172.16.0.0/12 to any label "block private networks from wan block 172.16/12"
block drop in log quick on xl0 inet from 192.168.0.0/16 to any label "block private networks from wan block 192.168/16"
block drop in log quick on ng0 inet from 192.168.0.0/16 to any label "block private networks from wan block 192.168/16"
anchor "limitingesr" all
block drop in quick from <virusprot> to any label "virusprot overload table"
anchor "wanbogons" all
block drop in log quick on xl0 from <bogons> to any label "block bogon networks from wan"
block drop in log quick on ng0 from <bogons> to any label "block bogon networks from wan"
pass out quick on xl1 proto icmp all keep state label "let out anything from firewall host itself"
pass out quick on xl0 proto icmp all keep state label "let out anything from firewall host itself"
pass out quick on ng0 proto icmp all keep state label "let out anything from firewall host itself"
pass out quick on ng0 all flags S/SA keep state (tcp.closed 5) label "let out anything from firewall host itself"
anchor "firewallout" all
pass out quick on xl0 all flags S/SA keep state label "let out anything from firewall host itself"
pass out quick on ng0 all flags S/SA keep state label "let out anything from firewall host itself"
pass out quick on xl1 all flags S/SA keep state label "let out anything from firewall host itself"
pass out quick on enc0 all flags S/SA keep state label "IPSEC internal host to host"
pass out quick on ng0 proto icmp all keep state (tcp.closed 5) label "let out anything from firewall host itself"
anchor "anti-lockout" all
pass in quick on xl1 inet from any to 10.0.0.1 flags S/SA keep state label "anti-lockout web rule"
block drop in log quick proto tcp from <sshlockout> to any port = ssh label "sshlockout"
anchor "ftpproxy" all
anchor "pftpx/*" all
pass in quick on xl0 inet proto tcp from any to 10.0.0.10 port = 5901 flags S/SA keep state label "USER_RULE: NAT VNC Appserver"
pass in quick on ng0 inet proto tcp from any to 10.0.0.10 port = 5901 flags S/SA keep state label "USER_RULE: NAT VNC Appserver"
pass in quick on xl0 inet proto tcp from any to 10.0.0.10 port = 8000 flags S/SA keep state label "USER_RULE: NAT SQL Admin"
pass in quick on ng0 inet proto tcp from any to 10.0.0.10 port = 8000 flags S/SA keep state label "USER_RULE: NAT SQL Admin"
pass in quick on xl0 inet proto tcp from any to 10.0.0.10 port = 8080 flags S/SA keep state label "USER_RULE: NAT RC Appserver"
pass in quick on ng0 inet proto tcp from any to 10.0.0.10 port = 8080 flags S/SA keep state label "USER_RULE: NAT RC Appserver"
pass in quick on xl0 inet proto tcp from any to 10.0.0.10 port = ssh flags S/SA keep state label "USER_RULE: NAT SSH (Appserver)"
pass in quick on ng0 inet proto tcp from any to 10.0.0.10 port = ssh flags S/SA keep state label "USER_RULE: NAT SSH (Appserver)"
pass in quick on xl1 inet from 10.0.0.0/24 to any flags S/SA keep state label "USER_RULE: Default LAN -> any"
pass in quick on xl1 inet proto tcp from any to 127.0.0.1 port = ftp-proxy flags S/SA keep state label "FTP PROXY: Allow traffic to localhost"
pass in quick on xl1 inet proto tcp from any to 127.0.0.1 port = ftp flags S/SA keep state label "FTP PROXY: Allow traffic to localhost"
pass in quick on ng0 inet proto tcp from any port = ftp-data to (ng0) port > 49000 flags S/SA keep state label "FTP PROXY: PASV mode data connection"
anchor "imspector" all
anchor "miniupnpd" all
block drop in log quick all label "Default deny rule"
block drop out log quick all label "Default deny rule"

# pfctl -sn
nat-anchor "pftpx/*" all
nat-anchor "natearly/*" all
nat-anchor "natrules/*" all
nat on xl0 inet from 10.0.0.0/24 port = isakmp to any port = isakmp -> (ng0) port 500 round-robin
nat on ng0 inet from 10.0.0.0/24 port = isakmp to any port = isakmp -> (ng0) port 500 round-robin
nat on xl0 inet from 10.0.0.0/24 port = 5060 to any port = 5060 -> (ng0) port 5060 round-robin
nat on ng0 inet from 10.0.0.0/24 port = 5060 to any port = 5060 -> (ng0) port 5060 round-robin
nat on xl0 inet from 10.0.0.0/24 to any -> (ng0) port 1024:65535 round-robin
nat on ng0 inet from 10.0.0.0/24 to any -> (ng0) port 1024:65535 round-robin
rdr-anchor "pftpx/*" all
rdr-anchor "slb" all
no rdr on xl1 proto tcp from any to <vpns> port = ftp
rdr on xl1 inet proto tcp from any to any port = ftp -> 127.0.0.1 port 8021
rdr on ng0 inet proto tcp from any to any port = 5901 -> 10.0.0.10
rdr on ng0 inet proto tcp from any to any port = 8089 -> 10.0.0.10 port 8000
rdr on ng0 inet proto tcp from any to any port = http -> 10.0.0.10 port 8080
rdr on ng0 inet proto tcp from any to any port = 2222 -> 10.0.0.10 port 22
rdr-anchor "imspector" all
rdr-anchor "miniupnpd" all