#	$OpenBSD: pf.conf,v 1.55 2017/12/03 20:40:04 sthen Exp $
#
# See pf.conf(5) and /etc/examples/pf.conf
wan="em0"
wan2="igc0"
lan="em1"
admin="em2"
wifi="vlan4"
guests="vlan6"
iot="vlan10"
vpn="vlan20"
nas="vlan30"
all_int="em0 igc0 em1 em2 vlan4 vlan6 vlan10 vlan20 vlan30"
DNS_Bachelors="{ em1 em2 vlan4 vlan6 vlan10 vlan20 vlan30 }"
Unsafe_Networks_LAN="{vlan4:network vlan6:network vlan10:network vlan20:network vlan30:network em2:network}"
Unsafe_Networks_WIFI="{vlan6:network vlan10:network vlan20:network vlan30:network em2:network}"
Unsafe_Networks_Admin="{vlan4:network vlan6:network vlan10:network vlan20:network vlan30:network}"
Unsafe_Networks_IoT="{vlan6:network vlan20:network vlan30:network em2:network}"
Unsafe_Networks_Guests="{vlan10:network vlan20:network vlan30:network em2:network}"
Unsafe_Networks_NAS="{vlan6:network vlan10:network vlan20:network em2:network}"
Unsafe_Networks_VPN="{vlan6:network vlan10:network vlan30:network em2:network}"
DNS_Network="{192.168.0.3 192.168.0.5 192.168.0.4 192.168.0.6 192.168.0.15}"
DNS_Ports="{53 853 5353}"
TCP_Services = "{ 53 68 80 88 110 123 443 465 500 546 853 993 1024:65535 }"
UDP_Services = "{ 53 68 80 88 123 443 500 546 853 1024:65535 }"
XBOX_Ports="{53 80 88 500 3074 3544 4500}"
XBOX="{192.168.10.22}"
PiVPN="{20.20.20.2}"
DNS_Set_1="{192.168.0.6 192.168.0.4}"
DNS_Set_2="{192.168.0.3 192.168.0.5}"
NAS_1="{192.168.30.251 192.168.30.51 192.168.30.253}"
NAS1_Ports="{7 9 443 1024:65535}"
Anti_Lockout_Ports="{22}"
PC_Group="{192.168.0.10:192.168.0.13}"
VPN_Ports="{22 443}"
WIFI_MDNS_Networks="{192.168.30.0/24 192.168.10.0/24 20.20.20.0/24}"
table <pfbadhost> persist file "/etc/pf-badhost.txt"
block in quick on egress from <pfbadhost>
block out quick on egress to <pfbadhost>
set skip on { lo em3 }
set block-policy drop
set optimization conservative
set loginterface egress
set limit table-entries 500000
set limit states 50000
set limit src-nodes 50000
set timeout { udp.first 300, udp.single 150, udp.multiple 900 }
set timeout { adaptive.start 10000, adaptive.end 45000 }
set syncookies adaptive (start 60%, end 30%)

block drop log all	# block stateless traffic
#pass out quick inet keep state (no-sync) 		# establish keep-state
pass out on $wan from $wan:network to any keep state 

# Pass in IPV6 Stuff
pass in on egress inet6 proto icmp6 all icmp6-type { routeradv neighbrsol neighbradv }
pass in on egress inet6 proto udp from fe80::/10 port dhcpv6-server to fe80::/10 port dhcpv6-client no state

# Spoofing protection for all NICs.
block in from no-route to any 
block in log quick from urpf-failed to any 

# Scrub in and match out
match in inet all scrub (no-df random-id reassemble tcp max-mss 1448)
#match in inet6 all scrub (reassemble tcp max-mss 1428)
match out on egress from !(egress:network) to any nat-to (egress:0)

# LAN Rules
block in quick on $lan from $Unsafe_Networks_LAN to $lan:network
pass in on $lan from $lan:network to any keep state (no-sync)
pass out on $wan from $lan:network to any nat-to ($wan) keep state (no-sync)
pass in quick on $lan proto { tcp udp } from $DNS_Bachelors to $DNS_Network port $DNS_Ports keep state ( no-sync)

# Admin Rules
block quick on $admin from $Unsafe_Networks_Admin to $admin:network 
pass in on $admin from $admin:network to any keep state (no-sync)
pass out on $wan from $admin:network to any nat-to ($wan) keep state (no-sync)

# Wifi Rules
block in quick on $wifi from $Unsafe_Networks_WIFI to $wifi:network
pass in on $wifi from $wifi:network to any keep state (no-sync)
pass out on $wan from $wifi:network to any nat-to ($wan) keep state (no-sync)
pass in on $wifi inet proto udp from $WIFI_MDNS_Networks port 5353 to any keep state (no-sync) allow-opts

# Guests Rules
block quick on $guests from $Unsafe_Networks_Guests to $guests:network
pass in on $guests from $guests:network to any keep state (no-sync)
pass out on $wan from $guests:network to any nat-to ($wan) keep state (no-sync)

# IoT Rules
block quick on $iot from $Unsafe_Networks_IoT to $iot:network
pass in on $iot from $iot:network to any keep state (no-sync)
pass out on $wan from $iot:network to any nat-to ($wan) keep state (no-sync)
pass in on egress proto udp from any to any port $XBOX_Ports rdr-to $XBOX synproxy state (no-sync)

# Vpn Rules
block quick on $vpn from $Unsafe_Networks_VPN to $vpn:network
pass in on $vpn from $vpn:network to any keep state (no-sync)
pass out on $wan from $vpn:network to any nat-to ($wan) keep state (no-sync)
pass in on egress proto udp from any to any port 51820 rdr-to $PiVPN

# Nas Rules
block quick on $nas from $Unsafe_Networks_NAS to $nas:network
pass in on $nas from $nas:network to any keep state (no-sync)
pass out on $wan from $nas:network to any nat-to ($wan) keep state (no-sync)
pass in quick on $nas inet proto {tcp udp} from $PiVPN to $NAS_1 port $NAS1_Ports keep state (no-sync)


# By default, do not permit remote connections to X11
#block return in on ! lo0 proto tcp to port 6000:6010

# Port build user does not need network
#block return out log proto {tcp udp} user _pbuild
