#	$OpenBSD: pf.conf,v 1.55 2017/12/03 20:40:04 sthen Exp $
#
# See pf.conf(5) and /etc/examples/pf.conf
table <pfbadhost> persist file "/etc/pf-badhost.txt"
table <martians> { 0.0.0.0/8 127.0.0.0/8 169.254.0.0/16 172.16.0.0/12 192.0.0.0/24 192.0.2.0/24 224.0.0.0/3 \
                   192.168.0.0/16 198.18.0.0/15 198.51.100.0/24 203.0.113.0/24 \
                   ::/128 ::/96 ::1/128 ::ffff:0:0/96 100::/64 2001:10::/28 2001:2::/48 2001:db8::/32 3ffe::/16 fec0::/10 fc00::/7 }
table <multicast_networks> {239.255.255.250 ff02::c ff05::c ff08::c ff08::c}
table <unsafe_nets_fw> {vlan4:network vlan6:network vlan8:network vlan10:network}
table <multicast_ntwks> {224.0.0.0/4 ff00::/8}
table <unsafe_lan> {vlan2:network vlan4:network vlan6:network vlan8:network vlan10:network ix1:network}
table <unsafe_wifi> {vlan4:network vlan6:network vlan8:network vlan10:network ix1:network}
table <unsafe_iot> {vlan6:network vlan8:network vlan10:network ix1:network}
table <unsafe_nas> {vlan4:network vlan8:network vlan10:network ix1:network}
table <unsafe_guests>{vlan4:network vlan8:network vlan10:network ix1:network}
table <unsafe_dmz> {vlan4:network vlan6:network vlan8:network ix1:network}
table <unsafe_admin> {vlan2:network vlan4:network vlan6:network vlan8:network vlan10:network}
table <unsafe_multicast> {vlan4:network vlan6:network vlan10:network}
table <mdns_net> {224.0.0.251 ff02::fb}
table <xbox_addr> {192.168.10.3/32}
table <ntp_addr> {192.168.1.3/32 192.168.1.4/32}
table <fw_dns> {127.0.0.1 ::1 self}
table <fw_ntp> { 127.0.0.1 ::1 self}
table <self> {self}
table <lan> {ix0:network}
table <wifi> {vlan2:network}
table <iot> {vlan4:network}
table <nas> {vlan6:network}
table <guests> {vlan8:network}
table <dmz> {vlan10:network}
table <admin> {ix1:network}
table <dhcpv6net> {fe80::/10}
fwm_ports = "{22 443 8443 80 8080 65535}"
dns_net = "{vlan2 vlan4 vlan6 vlan8 vlan10}"
xbox_ports = "{53 80 88 500 3074 3544 4500}"
rdr_ports = "{53 123}"
unsafe_nets = "{vlan4 vlan6 vlan8 vlan10}"
unsafe_mnets = "{vlan4 vlan6 vlan10}"
unsafe_lan = "{vlan2 vlan4 vlan6 vlan8 vlan10 ix1}"
unsafe_wifi = "{vlan4 vlan6 vlan8 vlan10 ix1}"
unsafe_iot = "{vlan6 vlan8 vlan10 ix1}"
unsafe_nas = "{vlan4 vlan8 vlan10 ix1}"
unsafe_guests = "{vlan4 vlan8 vlan10 ix1}"
unsafe_dmz = "{vlan4 vlan6 vlan8 ix1}"
unsafe_admin = "{vlan2 vlan4 vlan6 vlan8 vlan10}"
all_nets = "{ix0 ix1 vlan2 vlan4 vlan6 vlan8 vlan10}"
wan = "igc0"
lan = "ix0"
wifi = "vlan2"
iot = "vlan4"
nas = "vlan6"
guests = "vlan8"
dmz = "vlan10"
admin = "ix1"
set block-policy drop
set loginterface egress 
set optimization conservative
set syncookies adaptive (start 60%, end 30%)
set timeout tcp.established 1800
set state-defaults no-sync
set limit table-entries 40000000
set skip on {lo,iwx,enc}

# Matching and NAT
block in quick on egress from <pfbadhost>
block out quick on egress to <pfbadhost>
block in quick on egress from <martians> to any
block return out quick on egress from any to <martians>
block in quick from urpf-failed label uRPF
block in quick from no-route
block in quick on egress from any to <martians>
block drop all # block stateless traffic
match in all scrub (no-df random-id reassemble tcp)
match in on $dmz from <xbox_addr> tag SeriesS
match out log (all) on egress inet to any nat-to (egress:0) static-port tagged SeriesS
match out on egress inet from !(egress:network) to any nat-to (egress:0)
pass out quick # establish keep-state

# Intervlan Communication
pass in quick on $dns_net proto {udp tcp} from any to any port domain rdr-to <fw_dns> port domain set tos ef
pass in quick on $dns_net proto {udp tcp} from any to any port 123 rdr-to <fw_ntp> port 123 set tos ef
pass quick on $all_nets proto {tcp udp} from any to <self> port $rdr_ports set tos ef
block in quick on $unsafe_nets proto {tcp udp} from <unsafe_nets_fw> to <self> port $fwm_ports
pass in on $all_nets
block in on $unsafe_lan from <unsafe_lan> to <lan>
block in on $unsafe_wifi from <unsafe_wifi> to <wifi>
block in on $unsafe_iot from <unsafe_iot> to <iot>
block in on $unsafe_nas from <unsafe_nas> to <nas>
block in on $unsafe_guests from <unsafe_guests> to <guests>
block in on $unsafe_dmz from <unsafe_dmz> to <dmz>
block in on $unsafe_admin from <unsafe_admin> to <admin>
pass on $wifi proto {tcp icmp icmp6} from <wifi> to <ntp_addr>
pass on $unsafe_mnets proto {tcp udp} from <unsafe_multicast> port 1024:65535 to <wifi> port 1024:65535 allow-opts
pass on $unsafe_mnets proto {tcp udp} from <unsafe_multicast> port {mdns ssdp} to <lan> port {mdns ssdp} allow-opts
# UPNP/Port Forward/Xbox Match Rules
anchor "miniupnpd"


# Rules for Firewall
pass proto {udp tcp} from any to <multicast_ntwks> port {mdns ssdp} allow-opts
pass proto igmp all allow-opts
pass in on egress inet6 proto icmp6 all icmp6-type { routeradv neighbrsol neighbradv }
pass in on egress inet6 proto udp from <dhcpv6net> port dhcpv6-server to <dhcpv6net> port dhcpv6-client no state
# By default, do not permit remote connections to X11
block return in on ! lo0 proto tcp to port 6000:6010
# Port build user does not need network
block return out log proto {tcp udp} user _pbuild

# Queuing for Bufferbloat
queue outq on $wan flows 1024 bandwidth 30M max 30M qlimit 320 default quantum 300
queue inq on $all_nets flows 1024 bandwidth 750M max 750M qlimit 1024 default quantum 300
