ext_if = "xl0"
int_if = "rl0"
game_srv = "192.168.82.2"
dns_srvs = "{ 10.100.1.1, 10.100.1.2 }"
icmp_types = "echoreq"table <banned> { 10.110.52.34, 10.100.41.30, 10.100.41.77 }
table <rdp_users> { 10.100.41.33, 10.100.41.13, 10.100.41.9, 10.100.41.10 }
table <ssh_users> { 10.100.41.222, 10.100.41.33, 10.100.41.9,\
10.100.41.221, 10.100.57.20 }
table <smb_users> { 10.100.41.33, 10.100.41.9, 10.100.48.48,\
10.100.41.221, 10.100.41.222 }
set block-policy return
set loginterface $ext_if
scrub in all
rdr pass on $ext_if proto tcp from <rdp_users> to port 3389\
-> $game_srv port 3389
rdr pass on $ext_if proto udp to port 27015\
-> $game_srv port 27015
rdr pass on $ext_if proto udp to port 27016\
-> $game_srv port 27016
rdr pass on $ext_if proto udp to port 27017\
-> $game_srv port 27017
rdr pass on $ext_if proto udp to port 27018\
-> $game_srv port 27018
block log all
pass quick on lo0 all
pass inet proto icmp all icmp-type $icmp_types keep state
pass out on $ext_if proto { tcp, udp } from any to $dns_srvs port domain\
keep state
block drop in quick on $ext_if from <banned> to any
pass in on $ext_if proto tcp from any to ($ext_if) port 21 flags S/SA\
keep state
pass in on $ext_if proto tcp from any to ($ext_if) port >49151 flags S/SA\
keep state
pass out on $ext_if proto tcp from ($ext_if) to any port 20 flags S/SA\
keep state
pass in on $ext_if proto tcp from any to ($ext_if) port 80 flags S/SA\
keep state
pass in on $ext_if proto tcp from <rdp_users> to ($ext_if) port 3389\
flags S/SA keep state
pass out on $int_if proto tcp from any to $game_srv port 3389 keep state
pass in on $ext_if proto udp from any to ($ext_if) port\
{ 27015, 27016, 27017, 27018 } keep state
pass out on $int_if proto udp from any to $game_srv port\
{ 27015, 27016, 27017, 27018 } keep state
pass in on $ext_if proto tcp from <ssh_users> to ($ext_if) port 22\
flags S/SA keep state
pass in on $ext_if proto tcp from <smb_users> to ($ext_if) port { 139, 445 }\
keep state
