#	$OpenBSD: pf.conf,v 1.55 2017/12/03 20:40:04 sthen Exp $
#
# See pf.conf(5) and /etc/examples/pf.conf
anchor "miniupnpd"
table <pfbadhost> persist file "/etc/pf-badhost.txt"
table <martians> { 0.0.0.0/8 127.0.0.0/8 169.254.0.0/16 172.16.0.0/12 192.0.0.0/24 192.0.2.0/24 224.0.0.0/3 \
                   192.168.0.0/16 198.18.0.0/15 198.51.100.0/24 203.0.113.0/24 \
                   ::/128 ::/96 ::1/128 ::ffff:0:0/96 100::/64 2001:10::/28 2001:2::/48 2001:db8::/32 3ffe::/16 fec0::/10 fc00::/7 }
table <multicast_networks> {239.255.255.250 ff02::c ff05::c ff08::c ff08::c}
table <safe_nets> {vlan2:network ix0:network}
table <unsafe_nets_fw> {vlan4:network vlan6:network vlan8:network vlan10:network}
table <multicast_ntwks> {224.0.0.0/4 ff00::/8}
table <unsafe_lan> {vlan2:network vlan4:network vlan6:network vlan8:network vlan10:network ix1:network}
table <unsafe_wifi> {vlan4:network vlan6:network vlan8:network vlan10:network ix1:network}
table <unsafe_iot> {vlan6:network vlan8:network vlan10:network ix1:network}
table <unsafe_nas> {vlan4:network vlan8:network vlan10:network ix1:network}
table <unsafe_guests>{vlan4:network vlan8:network vlan10:network ix1:network}
table <unsafe_dmz> {vlan4:network vlan6:network vlan8:network ix1:network}
table <unsafe_admin> {vlan2:network vlan4:network vlan6:network vlan8:network vlan10:network}
table <unsafe_multicast> {vlan4:network vlan6:network vlan10:network}
table <xbox_addr> {192.168.10.3/32}
egress_xbox = "{egress:network 192.168.10.3/32}"
fwm_ports = "{22,443,8443,80,8080}"
table <dns_net> {vlan2:network vlan4:network vlan6:network vlan8:network vlan10:network}
table <fw_addr> { 127.0.0.1 ::1}
dns_net = "{vlan2 vlan4 vlan6 vlan8 vlan10}"
multicast_nets = "{ix0 vlan2 vlan4 vlan6 vlan10}"
media_ports = "{5353 1900}"
xbox_ports = "{53 80 88 500 3074 3544 4500}"
safe_nets = "{vlan2 ix0}"
unsafe_nets = "{vlan4 vlan6 vlan8 vlan10}"
unsafe_lan = "{vlan2 vlan4 vlan6 vlan8 vlan10 ix1}"
unsafe_wifi = "{vlan4 vlan6 vlan8 vlan10 ix1}"
unsafe_iot = "{vlan6 vlan8 vlan10 ix1}"
unsafe_nas = "{vlan4 vlan8 vlan10 ix1}"
unsafe_guests = "{vlan4 vlan8 vlan10 ix1}"
unsafe_dmz = "{vlan4 vlan6 vlan8 ix1}"
unsafe_admin = "{vlan2 vlan4 vlan6 vlan8 vlan10}"
all_nets = "{ix0 ix1 vlan2 vlan4 vlan6 vlan8 vlan10}"
main_nets = "{vlan2 ix0}"
wan = "igc0"
lan = "ix0"
wifi = "vlan2"
iot = "vlan4"
nas = "vlan6"
guests = "vlan8"
dmz = "vlan10"
admin = "ix1"
set block-policy drop
set loginterface egress 
set debug warning
set optimization conservative
set syncookies adaptive (start 60%, end 30%)
set timeout tcp.established 1800
set state-defaults no-sync
set limit table-entries 40000000
set skip on {lo,iwx}

# Queuing for Bufferbloat
queue outq on $wan flows 1024 bandwidth 30M max 30M qlimit 320 default quantum 300
queue inq on $all_nets flows 1024 bandwidth 525M max 525M qlimit 320 default quantum 300

# Matching and NAT
block drop all # block stateless traffic
block in from no-route
block in on egress from any to <martians>
match in all scrub (no-df random-id reassemble tcp)
match out on egress inet from !(egress:network) to any nat-to (egress:0)
block in quick on egress from <pfbadhost>
block out quick on egress to <pfbadhost>
block in quick from urpf-failed label uRPF
block in quick on egress from <martians> to any
block return out quick on egress from any to <martians>
pass in on $all_nets
pass in on egress inet6 proto udp from fe80::/10 port dhcpv6-server to fe80::/10 port dhcpv6-client no state
pass inet6 proto icmp6 all
pass on $multicast_nets proto igmp all allow-opts
pass on $multicast_nets proto udp from any to <multicast_ntwks>
pass on $multicast_nets proto udp from any to <multicast_networks> port ssdp allow-opts
pass in on $multicast_nets proto udp to self port 5351
pass out quick # establish keep-state

# Xbox Rules
# Do not perform source-port randomization for the xbox - IMPORTANT
#match out quick log on egress inet from <xbox_addr> to any nat-to (egress:0) static-port
#pass in quick on egress inet proto {tcp udp} from any to egress port $xbox_ports rdr-to <xbox_addr>

# Rules for Firewall 
pass in quick on $dns_net proto { udp, tcp } from any to any port domain rdr-to <fw_addr> port domain
block in quick on $unsafe_nets proto {tcp udp} from <unsafe_nets_fw> to self port $fwm_ports

# Intervlan Communication
pass in quick on $safe_nets proto igmp from <unsafe_multicast> to <safe_nets>
pass in quick on $safe_nets proto udp from <unsafe_multicast> to <safe_nets> port $media_ports
block in quick on $unsafe_lan from <unsafe_lan> to $lan:network
block in quick on $unsafe_wifi from <unsafe_wifi> to $wifi:network
block in quick on $unsafe_iot from <unsafe_iot> to $iot:network
block in quick on $unsafe_nas from <unsafe_nas> to $nas:network
block in quick on $unsafe_guests from <unsafe_guests> to $guests:network
block in quick on $unsafe_dmz from <unsafe_dmz> to $dmz:network
block in quick on $unsafe_admin from <unsafe_admin> to $admin:network

# By default, do not permit remote connections to X11
block return in on ! lo0 proto tcp to port 6000:6010

# Port build user does not need network
block return out log proto {tcp udp} user _pbuild
