
set limit { frags 5000, states 10000 }
set optimization aggressive
set timeout tcp.first 5
set timeout tcp.opening 5
set timeout tcp.established 10


#
# Prolog script
#
# prolog
# prolog commands go after set commands

#
# End of prolog script
#
#
# Scrub rules
#
scrub in all fragment reassemble no-df 
scrub out all random-id min-ttl  32 max-mss  1460


# Tables: (4)
table <tbl.r1> { 192.168.1.10 , 192.168.1.20 } 
table <tbl.r16> { eth4 , 22.22.22.22 , 22.22.23.23 , 192.168.1.1 , 192.168.2.1 } 
table <tbl.r29> { 192.168.1.0/24 , 192.168.2.0/24 } 
table <tbl.r5.s> { self  , 192.168.1.0/24 } 

# 
# Rule  0 (NAT)
nat on  eth0 from 192.168.1.0/24 to any -> (eth0) 
nat on  eth1 from 192.168.1.0/24 to any -> (eth1) 
nat on  eth3 from 192.168.1.0/24 to any -> (eth3) 
nat on  eth2 from 192.168.1.0/24 to any -> (eth2) 
nat on  eth4 from 192.168.1.0/24 to any -> (eth4) 
# 
# Rule  1 (NAT)
nat from <tbl.r1> to any -> 22.22.22.23 
# 
# Rule  2 (NAT)
nat from 192.168.1.0/24 to <tbl.r1> -> 192.168.1.1 
# 
# Rule  3 (NAT)
nat on  eth0 proto tcp from 192.168.1.0/24 to any port 80 -> (eth0) 
nat on  eth1 proto tcp from 192.168.1.0/24 to any port 80 -> (eth1) 
nat on  eth3 proto tcp from 192.168.1.0/24 to any port 80 -> (eth3) 
nat on  eth2 proto tcp from 192.168.1.0/24 to any port 80 -> (eth2) 
nat on  eth4 proto tcp from 192.168.1.0/24 to any port 80 -> (eth4) 
# 
# Rule  4 (NAT)
nat proto tcp from <tbl.r1> to any port 80 -> 22.22.22.23 
# 
# Rule  5 (NAT)
nat proto tcp from 192.168.1.0/24 to <tbl.r1> port 80 -> 192.168.1.1 
# 
# Rule  6 (NAT)
nat on  eth0 proto 47 from 192.168.1.0/24 to any -> (eth0) 
nat on  eth1 proto 47 from 192.168.1.0/24 to any -> (eth1) 
nat on  eth3 proto 47 from 192.168.1.0/24 to any -> (eth3) 
nat on  eth2 proto 47 from 192.168.1.0/24 to any -> (eth2) 
nat on  eth4 proto 47 from 192.168.1.0/24 to any -> (eth4) 
# 
# Rule  7 (NAT)
nat proto icmp from <tbl.r1> to any -> 22.22.22.23 
# 
# Rule  8 (NAT)
nat proto udp from 192.168.1.0/24 to <tbl.r1> port 53 -> 192.168.1.1 
# 
# Rule  9 (NAT)
rdr from any to 22.22.22.23 -> 192.168.1.10 
# 
# Rule  10 (NAT)
rdr proto tcp from any to 22.22.22.23 port 80 -> 192.168.1.10 port 80 
rdr proto tcp from any to 22.22.22.23 port 119 -> 192.168.1.10 port 119 
# 
# Rule  11 (NAT)
rdr proto tcp from any to 22.22.22.22 port 119 -> 192.168.1.10 port 119 
# 
# Rule  12 (NAT)
nat from 192.168.1.20 to any -> 22.22.23.24 
# 
# Rule  16 (NAT)
rdr from any to <tbl.r16> -> 192.168.1.10 
# 
# Rule  17 (NAT)
rdr on  eth1 from any to 22.22.22.22 -> 192.168.1.10 
# 
# Rule  18 (NAT)
rdr on  eth1 from any to 22.22.22.22 -> 192.168.1.10 
# 
# Rule  19 (NAT)
rdr proto 47 from any to <tbl.r16> -> 192.168.1.10 
# 
# Rule  20 (NAT)
rdr proto tcp from any to <tbl.r16> port 10000:11000 -> 192.168.1.10 port 10000:* 
# 
# Rule  21 (NAT)
rdr on  eth1 proto tcp from any to 22.22.22.22 port 10000:11000 -> 192.168.1.10 port 10000:* 
# 
# Rule  22 (NAT)
rdr on  eth1 proto tcp from any to 22.22.22.22 port 10000:11000 -> 192.168.1.10 port 10000:* 
# 
# Rule  23 (NAT)
rdr on  eth1 proto tcp from any to 22.22.22.22 port 10000:11000 -> 192.168.1.10 port 10000:* 
nat on  eth0 proto tcp from any to 192.168.1.10 port 10000:11000 -> 192.168.1.1 
# 
# Rule  24 (NAT)
rdr proto tcp from any to 22.22.22.23 port 80 -> 192.168.1.10 port 25 
# 
# Rule  25 (NAT)
rdr proto tcp from 192.168.1.0/24 to any port 80 -> 127.0.0.1 port 80 
# 
# Rule  26 (NAT)
rdr proto tcp from 192.168.1.0/24 to any port 80 -> (eth0) port 80 
# 
# Rule  27 (NAT)
rdr proto tcp from any to <tbl.r16> port 1080 -> 127.0.0.1 port 80 
# 
# Rule  28 (NAT)
# SF bug 3162862
rdr proto tcp from 192.168.1.0/24 to ! 192.168.1.0/24 port 80 -> 192.168.1.10 port 10000:* 
# 
# Rule  29 (NAT)
# SF bug 3162862
rdr proto tcp from 192.168.1.0/24 to ! <tbl.r29> port 80 -> 192.168.1.10 port 10000:* 
# 
# Rule  30 (NAT)
# SF bug 3162862
rdr proto tcp from 192.168.1.0/24 to ! <tbl.r29> port 80 -> 127.0.0.1 port 10000:* 
# 
# Rule  31 (NAT)
# for bug 1111267: this custom service object has
# "proto ..." in the protocol string, compiler can put
# it in generated nat command in the right place.
nat on  eth1 proto  {tcp udp icmp gre} from 192.168.1.0/24 to any -> 22.22.22.22 
# 
# Rule  32 (NAT)
# for bug 1111267: this custom service object
# has "proto .." in the code string but we can't insert
# it in the generated nat command b/c it would appear 
# in the wrong place, after "from".
nat on  eth1 from 192.168.1.0/24 to any -> 22.22.22.22 
# 
# Rule  33 (NAT)
nat on  eth1 proto tcp from 192.168.1.0/24 to any  -> 22.22.22.22 
nat on  eth1 proto udp from 192.168.1.0/24 to any  -> 22.22.22.22 
nat on  eth1 proto 47 from 192.168.1.0/24 to any -> 22.22.22.22 
nat on  eth1 proto icmp from 192.168.1.0/24 to any -> 22.22.22.22 
# 
# Rule  34 (NAT)
nat on  eth0 proto tcp from 192.168.1.0/24 to any port 80 -> (eth0) 
# 
# Rule  35 (NAT)
nat on  eth4 proto tcp from 192.168.1.0/24 to any port 80 -> (eth4) 
# 
# Rule  36 (NAT)
rdr proto tcp from any to 22.22.22.22 port 119 -> { 192.168.1.10 , 255.255.255.255 } port 119 
# 
# Rule  37 (NAT)
rdr on  eth1 proto tcp from any to (eth1) port 119 -> { 192.168.1.10 , 255.255.255.255 } port 119 round-robin 
# 
# Rule  38 (NAT)
nat from eth0:network to any -> 22.22.22.0/24 
# 
# Rule  39 (NAT)
nat from eth0:network to any -> eth1:network 

# Policy compiler errors and warnings:
# firewall2:Policy:12: warning: Changing rule direction due to self reference
# 
# Rule  backup ssh access rule
#    backup ssh access rule 
pass in   quick inet proto tcp  from 192.168.1.100  to self port 22 keep state  label "RULE -1 - ACCEPT **"  
# 
# Rule  0 (eth0)
block in   log  quick on eth0 inet  from ! 192.168.1.0/24  to any  label "RULE 0 - DROP **"  
# 
# Rule  1 (eth1)
# Anti-spoofing rule
block in   log  quick on eth1 inet  from self  to any  label "Iface:  eth1 RULE 1 -- DROP **"  
block in   log  quick on eth1 inet  from 192.168.1.0/24  to any  label "Iface:  eth1 RULE 1 -- DROP **"  
# 
# Rule  2 (f2i1,3)
# rules 2,3,4 test group
# usage in interface
# all three rules should yield
# the same config
block in   log  quick on { eth1 eth3 } inet  from self  to any  label "Iface:  eth1 eth3 RULE 2 -- DROP **"  
block in   log  quick on { eth1 eth3 } inet  from 192.168.1.0/24  to any  label "Iface:  eth1 eth3 RULE 2 -- DROP **"  
# 
# Rule  3 (f2i1,eth3)
# Anti-spoofing rule
block in   log  quick on { eth1 eth3 } inet  from self  to any  label "Iface:  eth1 eth3 RULE 3 -- DROP **"  
block in   log  quick on { eth1 eth3 } inet  from 192.168.1.0/24  to any  label "Iface:  eth1 eth3 RULE 3 -- DROP **"  
# 
# Rule  4 (eth1,eth3)
# Anti-spoofing rule
block in   log  quick on { eth1 eth3 } inet  from self  to any  label "Iface:  eth1 eth3 RULE 4 -- DROP **"  
block in   log  quick on { eth1 eth3 } inet  from 192.168.1.0/24  to any  label "Iface:  eth1 eth3 RULE 4 -- DROP **"  
# 
# Rule  5 (eth1)
# Anti-spoofing rule
block out  log  quick on eth1 inet  from ! <tbl.r5.s>  to any  label "Iface:  eth1 RULE 5 -- DROP **"  
# 
# Rule  6 (global)
# block fragments
block  log  quick inet  from any  to any  fragment  label "RULE 6 - DROP **"  
# 
# Rule  7 (global)
# sends TCP RST and makes custom record in the log
block return-rst    log  quick inet proto tcp  from any  to any port 113  label "IDENT"  
# 
# Rule  8 (global)
pass  quick inet  from <tbl.r1>  to 200.200.200.200 keep state  label "RULE 8 - ACCEPT **"  
# 
# Rule  9 (global)
pass  quick inet  from 200.200.200.200  to <tbl.r1> keep state  label "RULE 9 - ACCEPT **"  
# 
# Rule  10 (global)
# 'masquerading' rule
pass  quick inet  from 192.168.1.0/24  to any keep state  label "RULE 10 - ACCEPT **"  
# 
# Rule  12 (global)
# firewall2:Policy:12: warning: Changing rule direction due to self reference

pass in   quick inet proto tcp  from any  to self port { 21, 80, 25 } keep state  label "RULE 12 - ACCEPT **"  
pass  quick inet proto tcp  from any  to 192.168.1.10 port { 21, 80, 25 } keep state  label "RULE 12 - ACCEPT **"  
# 
# Rule  13 (global)
# 'catch all' rule
block  log  quick inet  from any  to any  label "RULE 13 - DROP **"  
# 
# Rule  fallback rule
#    fallback rule 
block  quick inet  from any  to any  label "RULE 10000 - DROP **"  

