set optimization high-latency



# Tables: (3)
table <tbl.r2> { eth1 , 192.168.1.1 , 192.168.2.1 , 222.222.222.222 } 
table <tbl.r4.s> { self  , 192.168.1.0/24 } 
table <tbl.r6.s> { 192.168.1.10 , 192.168.1.20 } 


#
# Prolog script
#
# prolog commands go after table definitions

#
# End of prolog script
#
# 
# Rule  0 (NAT)
nat on  eth0 proto {tcp udp icmp} from 192.168.1.10 to any -> (eth0) 
nat on  eth1 proto {tcp udp icmp} from 192.168.1.10 to any -> (eth1) 
nat on  eth2 proto {tcp udp icmp} from 192.168.1.10 to any -> (eth2) 
nat on  eth3 proto {tcp udp icmp} from 192.168.1.10 to any -> (eth3) 
# 
# Rule  1 (NAT)
nat on  eth0 proto {tcp udp icmp} from 192.168.1.0/24 to ! 192.168.2.0/24 -> (eth0) 
nat on  eth1 proto {tcp udp icmp} from 192.168.1.0/24 to ! 192.168.2.0/24 -> (eth1) 
nat on  eth2 proto {tcp udp icmp} from 192.168.1.0/24 to ! 192.168.2.0/24 -> (eth2) 
nat on  eth3 proto {tcp udp icmp} from 192.168.1.0/24 to ! 192.168.2.0/24 -> (eth3) 
# 
# Rule  2 (NAT)
rdr proto tcp from any to <tbl.r2> port 22 -> 192.168.1.10 port 22 
# 
# Rule  3 (NAT)
# SDNAT rule
rdr on  eth3 proto tcp from 192.168.1.0/24 to 222.222.222.222 port 80 -> 192.168.1.10 port 80 
nat on  eth0 proto tcp from 192.168.1.0/24 to 192.168.1.10 port 80 -> (eth0) 
# 
# Rule  4 (NAT)
nat on  eth3 proto {tcp udp icmp} from 192.168.1.0/24 to any -> (eth3) 
# 
# Rule  5 (NAT)
# eth1 is dynamic
nat on  eth1 proto tcp from 192.168.1.0/24 to any port 22 -> (eth1) 

# Policy compiler errors and warnings:
# firewall4:Policy:6: warning: Changing rule direction due to self reference
# 
# Rule  0 (global)
anchor "ftp-proxy/*" inet  from any  to any 
# 
# Rule  1 (global)
pass  log  quick inet proto tcp  from any  to (eth1) port 22 keep state 
# 
# Rule  2 (eth1)
block  log  quick on eth1 inet proto icmp  from ! 192.168.2.0/24  to any icmp-type 8 code 0  
# 
# Rule  3 (eth1)
# Anti-spoofing rule
block in   log  quick on eth1 inet  from self  to any 
block in   log  quick on eth1 inet  from 192.168.1.0/24  to any 
# 
# Rule  4 (eth1)
# Anti-spoofing rule
block out  log  quick on eth1 inet  from ! <tbl.r4.s>  to any 
# 
# Rule  5 (global)
# hostF has the same IP address as firewal.
pass  log  quick inet proto icmp  from any  to 192.168.1.1 icmp-type 8 code 0  keep state 
# 
# Rule  6 (global)
# firewall4:Policy:6: warning: Changing rule direction due to self reference

block in   log  quick inet proto icmp  from ! <tbl.r6.s>  to self icmp-type 3  
# 
# Rule  7 (global)
# testing negation in the policy rule
block  log  quick inet proto icmp  from ! <tbl.r6.s>  to any icmp-type 3  
# 
# Rule  9 (global)
# 'masquerading' rule
pass  quick inet  from 192.168.1.0/24  to any keep state 
# 
# Rule  10 (global)
# 'catch all' rule
block  log  quick inet  from any  to any 
# 
# Rule  fallback rule
#    fallback rule 
block  quick inet  from any  to any