ext_inf1 = "sis0"
int_inf  = "sis1"

firewall = "10.0.1.3"
ext_ip1 = "<some address>"
dns = "10.0.1.3"

guests = "{10.0.1.0/24}"

table <loggedin> persist { 10.0.1.5, 10.0.1.10, 10.0.1.11, 10.0.1.200 }

###############################################################################################
#QOS                                                                                          #
###############################################################################################

altq on $ext_inf1 cbq bandwidth 832Kb queue { nodelay, high, medium, low, default, p2p }
 
        queue nodelay on $ext_inf1 bandwidth 256Kb priority 1 cbq(red ecn borrow) { sip, iax2, rtp }
                queue rtp on $ext_inf1 bandwidth 45% priority 1 cbq(red ecn borrow)
				queue sip bandwidth 10% priority 2 cbq(red ecn)
				queue iax2 bandwidth 45% priority 3 cbq(red ecn borrow)
	queue high on $ext_inf1 bandwidth 64Kb priority 2 cbq(red ecn borrow) { ssh, telnet, icmp }
                queue ssh bandwidth 75% priority 1 cbq(red ecn borrow)
                queue telnet bandwidth 10% priority 2 cbq(red ecn borrow)
                queue icmp bandwidth 15% priority 3 cbq(red ecn borrow)
        queue medium on $ext_inf1 bandwidth 224Kb priority 3 cbq(red ecn borrow) { dns, http, https }
                queue dns bandwidth 10% priority 1 cbq(red ecn borrow)
                queue http bandwidth 65% priority 2 cbq(red ecn borrow)
                queue https bandwidth 25% priority 2 cbq(red ecn borrow)
        queue low on $ext_inf1 bandwidth 96Kb priority 4 cbq(red ecn borrow) { ftp }
                queue ftp bandwidth 100% priority 1 cbq (red ecn)
      	queue default on $ext_inf1 bandwidth 64Kb priority 5 cbq (default)  
		queue p2p on $ext_inf1 bandwidth 128Kb priority 5 cbq(red ecn) { bittorrent, kazaa, limewire, emule, dc }
                queue bittorrent bandwidth 25% cbq (red ecn borrow)
                queue limewire bandwidth 25% cbq (red ecn borrow)
                queue emule bandwidth 25% cbq (red ecn borrow)
                queue dc bandwidth 25% cbq (red ecn borrow)

	

###############################################################################################
#Nat rules                                                                                    #
###############################################################################################

nat on $ext_inf1 from <loggedin> to any -> $ext_ip1


###############################################################################################
#Redirect rules                                                                               #
###############################################################################################

#Redirecting guest traffic to webserver
rdr on $int_inf proto tcp from !<loggedin> to any port http -> $firewall port http

###############################################################################################
#Filter queue rules                                                                           #
###############################################################################################

#nodelay
pass in on $int_inf proto udp from any to any port 10000:20000 queue rtp
pass in on $int_inf proto udp from any to any port 5060 queue sip
pass in on $int_inf proto tcp from any to any port 4569 queue ssh

#high
pass in on $int_inf proto tcp from any to any port 22 queue ssh
pass in on $int_inf proto tcp from any to any port 23 queue telnet
pass in on $int_inf proto icmp from any to any queue icmp

#medium
pass in on $int_inf proto tcp from any to any port domain queue dns
pass in on $int_inf proto udp from any to any port domain queue dns
pass in on $int_inf proto tcp from any to any port 80 queue http
pass in on $int_inf proto tcp from any to any port 443 queue https

#low
pass in on $int_inf proto tcp from any to any port 21 queue ftp
pass in on $int_inf proto tcp from any to any port 20 queue ftp 

#p2p
pass in on $int_inf proto tcp from any to any port 6881:6889 queue bittorrent
pass in on $int_inf proto tcp from any to any port 1214 queue limewire
pass in on $int_inf proto tcp from any to any port 6346 queue limewire
pass in on $int_inf proto udp from any to any port 6346 queue limewire
pass in on $int_inf proto tcp from any to any port 4662 queue emule
pass in on $int_inf proto udp from any to any port 4672 queue emule
pass in on $int_inf proto tcp from any to any port 411 queue dc
pass in on $int_inf proto tcp from any to any port 1412 queue dc
pass in on $int_inf proto udp from any to any port 1412 queue dc

###############################################################################################
#Filter rules                                                                                 #
###############################################################################################

#First block all traffic. This will make it easier to create a ruleset.
block in all
block out all

#Enabling ip-spoof protect
block in quick from urpf-failed

#Now allow traffic
pass out on $ext_inf1 from any to any
pass in on $int_inf from <loggedin>

#Allow traffic to localhost
pass in quick on lo all

#Allow rules for guests to let redirection to web work
pass in on $int_inf proto tcp from $guests to port www 
pass in on $int_inf proto tcp from $guests to port domain
pass in on $int_inf proto udp from $guests to port domain

#Allow external traffic 
pass in on $ext_inf1 proto tcp from any to $ext_inf1 port 22 
pass in on $ext_inf1 proto tcp from any to $ext_inf1 port 80
pass in on $ext_inf1 proto tcp from any to $ext_inf1 port 443
pass in on $ext_inf1 proto tcp from any to $ext_inf1 port 1194

#blocking Usenet
block in on $int_inf proto tcp from <loggedin> to any port 119

#allow wireless bridge
pass in on sis2 from any to 10.0.1.0/24 
pass in on ral0 from any to 10.0.1.0/24
