1

vpn_net = "192.168/16"

set block-policy return
set fingerprints "/etc/pf.os"
set ruleset-optimization basic
set skip on lo0

scrub in all no-df

scrub-anchor "com.apple/*"

int_if = "en0"
tun_if = "utun0"
no nat on ! $tun_if from $vpn_net to ($int_if)
nat on ! $tun_if from $vpn_net to ! ($int_if) -> ($int_if)

nat-anchor "com.apple/*"
rdr-anchor "com.apple/*"
dummynet-anchor "com.apple/*"
anchor "com.apple/*"
load anchor "com.apple" from "/etc/pf.anchors/com.apple"

anchor "com.apple.server-firewall/*"
load anchor "com.apple.server-firewall" from "/etc/pf.anchors/com.apple.server-firewall"

block all

pass in quick on $tun_if reply-to $tun_if from $vpn_net to $int_if

table <lan_inet> const { lo0, 10/8, 172.16/12, 192.168/16 }
table <lan_inet6> const { ::1, fe80::/10 }

pass quick inet from <lan_inet> to any keep state
pass quick inet6 from <lan_inet6> to any keep state

block drop in log quick from no-route to any
block drop in log quick from urpf-failed to any

table <bruteforce> persist
block drop log quick from <bruteforce>

anchor 'blockips' label "Open Source IP Blocks"
load anchor 'blockips' from '/usr/local/etc/blockips.conf'

icmp_types = "echoreq"
pass inet proto icmp from $int_if:network to any icmp-type $icmp_types
pass inet proto icmp from any to $int_if icmp-type $icmp_types

pass out on $int_if inet proto udp from any to any port 33433 >< 33626

pass in quick inet proto udp from port bootps to port bootpc
pass out quick inet proto udp from port bootpc to port bootps

lan_udp_services = "{ domain, 5001, postgresql }"
lan_tcp_services = "{ domain, auth, nntp, www,	\
	311, 3128, 5001, 5900:5909, privoxy, postgresql, 	\
	8123, 8180, 8181, 9150, 9151 }"
block in proto tcp from any to { lo0 $int_if } port $lan_tcp_services
block in proto udp from any to { lo0 $int_if } port $lan_udp_services

pass in proto udp from { lo0 $vpn_net $int_if:network } to { lo0 $int_if } port $lan_udp_services
pass in proto tcp from { lo0 $vpn_net $int_if:network } to { lo0 $int_if } port $lan_tcp_services

internet_udp_services = "{ https, 500, openvpn,	\
	1701, 4500, 5060, 5190, 5297, 5298, 5678, 16384 }"
internet_tcp_services = "{ 995, 1640, 1723, 2195,	\
	2196, 4190, 5218, 5223, 5190, 5220, 5222, 5298,		\
	8008, 8443, 8800, 8843, 9001, 9030 }"
pass in proto udp from any to { lo0 $int_if } port $internet_udp_services
pass in proto tcp from any to { lo0 $int_if } port $internet_tcp_services
apns_services = "{ 2195, 2196 }"
pass in proto tcp from any port $apns_services to <lan_inet>

pass in inet proto tcp from any to { lo0 $int_if } port ssh	\
	keep state (max-src-conn 5, max-src-conn-rate 5/2,		\
	overload <bruteforce> flush global)

pass in inet proto tcp from any to { lo0 $int_if }	\
	port { smtp, https, imap, submission, imaps, eyetv }		\
	keep state (max-src-nodes 50, max-src-conn 200, max-src-conn-rate 100/10,	\
	overload <bruteforce> flush global)
pass out inet proto tcp from $int_if port { imap4-ssl, imaps } to any