# $Id: pf.conf 2493 2016-01-09 19:29:00Z jhealy $
#
# Suffield Academy PF ruleset for border firewall.
#
# This setup assumes a redundant active-passive setup using two physical
# machines and a carp/pfsync setup to cluster them together.
#
# See http://web.suffieldacademy.org/ils/netadmin/docs/servers/pf/
#

###########################################################################
###                         Macros and Tables                           ###
###########################################################################

##
## Interface devices
##

# LAN physical interface
lan_if="vlan901"

# CEN WAN physical interface
cen_if="vlan1014"

# pfsync physical interface
pfsync_if="vlan915"


##
## Interface addresses
##

# LAN IP (CARP)
lan_ip="carp0:0"

# Firewall IP (unique to this host; use no-sync for rules on this IP)
fw_ip=$lan_if:0


##
## Address Pools
##

# Entire LAN range
table <suffield_lan> { 172.16.0.0/12 , 10.0.0.0/8 }

# All external IPs that we own
table <suffield_wan> { 72.10.118.0/23 }

# Netadmin addresses
table <netadmin> { 172.19.0.0/19 , 10.3.64.0/20 }

# Servers/Equipment
table <dmz> { 172.30.0.0/16 , 172.31.0.0/17 , 10.0.0.0/16 , 10.1.0.0/16  }

# Faculty/Staff
table <facstaff> { 172.18.0.0/16 , 172.28.0.0/16 , 10.3.0.0/16 }

# Students
table <student> { 10.4.0.0/16 , 172.17.0.0/16 }

# Guests
table <guest> { 10.5.0.0/16 , 172.16.0.0/16 }

# Hosts allowed to query our SNMP daemon
table <snmp> { 10.3.64.0/20 , 172.19.0.0/19 , 172.31.1.9 }

# Addresses to use for public nat pool
table <nat_default> { 72.10.119.220 }

table <nat_student> { 72.10.119.253 , 72.10.119.252 , 72.10.119.251 , \
      		      72.10.119.250 , 72.10.119.249 , 72.10.119.248 , \
                      72.10.119.247 , 72.10.119.246 , 72.10.119.245 }

table <nat_facstaff> { 72.10.119.244 , 72.10.119.243 , 72.10.119.242 }

table <nat_netadmin> { 72.10.119.241 }

table <nat_dmz> { 72.10.119.240 }

table <nat_guest> { 72.10.119.239 }

# Send all web traffic out over a single address to prevent tarded sites
# that don't like requests coming from more than one place
web_nat="72.10.119.238"
web_ports="{ http , https }"

# Bogus/private/evil IPs that we should never see
# (DHCP autoconfig, RESERVED, NET-TEST, MULTICAST D and E, RFC1918,
#  NULL, and LOOPBACK)
# [Suffield uses 172.16/12 and 10/8, though, so we don't list them here]
table <bogus> { 169.254.0.0/16 , 192.0.2.0/24, \
                224.0.0.0/4 , 240.0.0.0/4, \
                192.168.0.0/16 ,\
                0.0.0.0/8 , 127.0.0.0/8 }

# Portscanners (SSH bots, etc) that we want to tarpit/blackhole
table <portscanners> persist
table <portscanners_exempt> { 127.0.0.1 }

##
## Tags (used to defer "pass" decisions until later)
##

# tag for packets that are OK to send out (replaces vanilla "pass" rules)
accept="TAG_PASS"

# tag for packets that re NOT OK to send out (replaces vanilla "block" rules)
reject="TAG_BLOCK"


###########################################################################
###                              Options                                ###
###########################################################################

##
## Skip interfaces
##

# Completely ignore loopback (we should never filter our own traffic)
set skip on lo0

# Completely ignore pfsync interface (it's a crossover cable)
set skip on $pfsync_if


##
## Block policy
##

# Be nice and return an unreachable/rst packet for blocked packets
# set block-policy drop
set block-policy return


##
## Optimization
##

# Basic optimization removes duplicates, overlaps, and merges into tables
# to make rules more efficient.  Use "profile" to adaptively change rule order
set ruleset-optimization basic


##
## Logging
##

# Don't collect interface stats (we can use labels and anchors for that)
set loginterface none 

# Set noise level (none -> urgent -> misc -> loud)
set debug urgent


##
## Timeouts (see pfctl -s timeout)
##

# Allow clients 2 minutes to complete a handshake
set timeout tcp.first 120

# Allow 2 hours before we kill an idle connection
set timeout tcp.established 7200


##
## State limits
##

# Allow 30000 states at the maximum, with 15000 fragments tracked
set limit { states 30000 , frags 15000 }

# Once we pass 25000 states, start scaling the TTL on existing states
# to age them out more aggressively (until we hit 30000 and kill all)
set timeout { adaptive.start 25000 , adaptive.end 30000 }



###########################################################################
###                         Traffic Normalization                       ###
###########################################################################

# Reassemble fragments so we only have to deal with whole packets
# randomize ids for hosts that aren't smart enough to do it themselves
scrub in all random-id fragment reassemble

# Enforce TCP window and TTL behavior
#scrub all reassemble tcp
# jhealy: 2008/07/08: "reassemble tcp" still causes some problems with
#                     certain web servers (connections appear to hang).
#                     *sigh* -- disabling and only doing fragment reassm
scrub all



###########################################################################
###                            Translation                              ###
###########################################################################

##
## DMZ Servers (be sure to add to Packet Filtering section below as well)
##

# Sample
#sample_lan="172.30.0."
#sample_cen="72.10.118."
#sample_tcp="{  }"
#sample_udp="{  }"
#binat on $cen_if inet from $sample_lan to any -> $sample_cen

# Happitek (vagn's host)
happitek_lan="172.30.0.172"
happitek_cen="72.10.118.33"
happitek_tcp="{ http, https }"
#happitek_udp="{  }"
binat on $cen_if inet from $happitek_lan to any -> $happitek_cen

# Biblio (library website)
biblio_lan="172.30.0.170"
biblio_cen="72.10.118.26"
biblio_tcp="{ http, https }"
#biblio_udp="{  }"
binat on $cen_if inet from $biblio_lan to any -> $biblio_cen

# Luke (LDAP/Kerberos)
luke_lan="172.30.0.2"
luke_cen="72.10.118.2"
luke_tcp="{ kerberos , ldap , ldaps , submission }"
luke_udp="{ kerberos }"
binat on $cen_if inet from $luke_lan to any -> $luke_cen

# Leia (LDAP/Kerberos)
leia_lan="172.30.0.3"
leia_cen="72.10.118.3"
leia_tcp="{ kerberos , ldap , ldaps , submission }"
leia_udp="{ kerberos }"
binat on $cen_if inet from $leia_lan to any -> $leia_cen

# Werner (VPN)
werner_lan="172.30.0.9"
werner_cen="72.10.118.8"
werner_tcp="{ pptp }"
werner_udp="{ isakmp , ipsec-nat-t , 1701 , pptp }"
binat on $cen_if inet from $werner_lan to any -> $werner_cen

# Jamaica (Aruba master controller address for Remote AP deployment)
jamaica_lan="172.19.32.3"
jamaica_cen="72.10.118.31"
jamaica_udp="{ isakmp , ipsec-nat-t , 1701 }"
binat on $cen_if inet from $jamaica_lan to any -> $jamaica_cen

# Emma (FileMaker)
emma_lan="10.0.16.4"
emma_cen="72.10.118.4"
#emma_tcp="{ http , https }"
emma_tcp="{ 80, 443, 5003 }"
#emma_tcp="{ 22, 5900, 80, 5003, 16000, 16001, 16016, 16018, 2399, 16020, 16021 }"
binat on $cen_if inet from $emma_lan to any -> $emma_cen

# Tessa (File Server)
tessa_lan="172.30.0.105"
tessa_cen="72.10.118.5"
tessa_tcp="{ ssh , http , https , 3690 , 8008 , 8443 }"
# also 8096 8086 8087 ? for wiki, blog, ical
binat on $cen_if inet from $tessa_lan to any -> $tessa_cen

# Marion (Library Catalog / Streaming Server)
marion_lan="172.30.0.6"
marion_cen="72.10.118.6"
marion_tcp="{ http , rtsp , 7070 , 8000 , 8001 }"
marion_udp="{ 6970:6999 }"
binat on $cen_if inet from $marion_lan to any -> $marion_cen

# Omicron (Jason's web server)
omicron_lan="10.0.16.8"
omicron_cen="72.10.118.7"
binat on $cen_if inet from $omicron_lan to any -> $omicron_cen

# Gordon (FirstClass Core)
gordon_lan="172.30.0.115"
gordon_cen="72.10.118.29"
gordon_tcp="{ 510 , ssh }"
gordon_udp="{ 810 }"
binat on $cen_if inet from $gordon_lan to any -> $gordon_cen

# Reba (FirstClass Inet Svcs) [See below for Google/Postini SMTP]
reba_lan="172.30.0.116"
reba_cen="72.10.118.30"
reba_tcp="{ ssh , ftp-data , ftp , http , https , imap , imaps , 943 , 2195 }"
binat on $cen_if inet from $reba_lan to any -> $reba_cen

# Cliff (mailman listserver)
cliff_lan="172.30.0.84"
cliff_cen="72.10.118.9"
cliff_tcp="{ http , https , smtp }"
binat on $cen_if inet from $cliff_lan to any -> $cliff_cen

# Vader (Netadmin VPN / ssh)
vader_lan="172.19.0.4"
vader_cen="72.10.118.10"
vader_tcp="{ ssh }"
vader_udp="{ isakmp , ipsec-nat-t , 1701 }"
binat on $cen_if inet from $vader_lan to any -> $vader_cen

# Aragog (WWW: web, library, sphereschools)
aragog_lan="172.30.0.81"
aragog_cen="72.10.118.11"
aragog_tcp="{ http , https }"
binat on $cen_if inet from $aragog_lan to any -> $aragog_cen

# Dumbledore (WWW: moodle)
dumbledore_lan="172.30.0.90"
dumbledore_cen="72.10.118.12"
dumbledore_tcp="{ http , https }"
binat on $cen_if inet from $dumbledore_lan to any -> $dumbledore_cen

# RT (WWW: help / request tracker)
rt_lan="172.30.0.86"
rt_cen="72.10.118.13"
rt_tcp="{ http , https }"
binat on $cen_if inet from $rt_lan to any -> $rt_cen

# pr0n (ELF Sharing)
pr0n_lan="172.30.0.32"
pr0n_cen="72.10.118.14"
pr0n_tcp="{ http , https }"
binat on $cen_if inet from $pr0n_lan to any -> $pr0n_cen

# Austin (WWW: mojolicious)
austin_lan="172.30.0.69"
austin_cen="72.10.118.32"
austin_tcp="{ http , https }"
binat on $cen_if inet from $austin_lan to any -> $austin_cen

# Luigi (Game server: armagetron, bzFlag, teamspeak)
luigi_lan="172.30.0.23"
luigi_cen="72.10.118.15"
luigi_tcp="{ 4534 5154:5164 8767 14534 }"
luigi_udp="{ 4534 5154:5164 8767 14534 }"
binat on $cen_if inet from $luigi_lan to any -> $luigi_cen

# Yakko (NTP server)
yakko_lan="172.30.0.24"
yakko_cen="72.10.118.16"
yakko_tcp="{ ntp }"
yakko_udp="{ ntp }"
binat on $cen_if inet from $yakko_lan to any -> $yakko_cen

# Wakko (NTP server)
wakko_lan="172.30.0.25"
wakko_cen="72.10.118.17"
wakko_tcp="{ ntp }"
wakko_udp="{ ntp }"
binat on $cen_if inet from $wakko_lan to any -> $wakko_cen

# Dot (NTP server)
dot_lan="172.30.0.26"
dot_cen="72.10.118.18"
dot_tcp="{ ntp }"
dot_udp="{ ntp }"
binat on $cen_if inet from $dot_lan to any -> $dot_cen

# Nikko (Munki repository)
nikko_lan="10.0.32.12"
nikko_cen="72.10.118.36"
nikko_tcp="{ http , https }"
binat on $cen_if inet from $nikko_lan to any -> $nikko_cen

# Martin (start.suffieldacademy.org - network provisioning)
martin_lan="10.0.32.18"
martin_cen="72.10.118.37"
martin_tcp="{ http , https }"
binat on $cen_if inet from $martin_lan to any -> $martin_cen

##
## Vendor IPs (restricted and shared) 
##

vendor_cen="72.10.118.19"
vendor2_cen="72.10.118.34"

# SNE Building Management Server
snebms_ext="68.15.53.219"
snebms_lan="172.19.194.2"
snebms_cen=$vendor_cen
snebms_tcp="{ http , 3011 , 5800 , 5900 }"
rdr on $cen_if inet proto tcp from $snebms_ext \
    to $snebms_cen port $snebms_tcp -> $snebms_lan
nat on $cen_if inet from $snebms_lan to any -> $snebms_cen

# ABS Building Management Server
absbms_ext="{ 184.185.88.109 , 184.185.88.110 , 184.185.88.111 , 184.185.88.112 , 184.185.88.113 }"
absbms_lan="172.19.194.4"
absbms_cen=$vendor_cen
absbms_tcp="{ 5800 , 5900 }"
rdr on $cen_if inet proto tcp from $absbms_ext \
    to $absbms_cen port $absbms_tcp -> $absbms_lan
nat on $cen_if inet from $absbms_lan to any -> $absbms_cen

# IGX pro-vision (70.164.28.50 is dev address)
igxpv_ext="{ 185.57.93.34 , 209.59.162.52, 209.59.173.246, 209.59.161.252, 162.221.230.34, 173.166.14.226 , 70.164.28.50 }"
igxpv_tcp="{ 22 , 2222 }"
igxkvm_tcp="443"
igxpv1_lan="10.0.16.10"
igxpv2_lan="10.0.16.11"
igxkvm1_lan="10.0.16.12"
igxkvm2_lan="10.0.16.13"
igxpv1_cen=$vendor_cen
igxpv2_cen=$vendor2_cen
rdr on $cen_if inet proto tcp from $igxpv_ext \
    to $igxpv1_cen port $igxpv_tcp -> $igxpv1_lan
rdr on $cen_if inet proto tcp from $igxpv_ext \
    to $igxpv2_cen port $igxpv_tcp -> $igxpv2_lan
rdr on $cen_if inet proto tcp from $igxpv_ext \
    to $igxpv1_cen port $igxkvm_tcp -> $igxkvm1_lan
rdr on $cen_if inet proto tcp from $igxpv_ext \
    to $igxpv2_cen port $igxkvm_tcp -> $igxkvm2_lan
nat on $cen_if inet from $igxpv1_lan to any -> $igxpv1_cen
nat on $cen_if inet from $igxpv2_lan to any -> $igxpv2_cen
nat on $cen_if inet from $igxkvm1_lan to any -> $igxpv1_cen
nat on $cen_if inet from $igxkvm2_lan to any -> $igxpv2_cen

# IPerf Performance Testing
iperf_lan="172.31.1.16"
iperf_cen=$vendor_cen
iperf_ports="{ 5001 }"
rdr on $cen_if inet proto { tcp , udp } from any \
    to $iperf_cen port $iperf_ports -> $iperf_lan
nat on $cen_if inet from $iperf_lan to any -> $iperf_cen

# Enernoc (generator monitoring)
enernoc_ext="{ 216.93.250.70 , 8.192.1.0/25 , 8.192.160.0/25 }"
enernoc_cen=$vendor_cen
enernoc_tcp="502"

# Library generator
enernocl_lan="172.30.0.34"
enernocl_tcp="8034"
rdr on $cen_if inet proto tcp from $enernoc_ext \
    to $enernoc_cen port $enernocl_tcp -> $enernocl_lan port $enernoc_tcp
nat on $cen_if inet from $enernocl_lan to any -> $enernoc_cen

# Brewster generator
enernocb_lan="172.30.0.35"
enernocb_tcp="8035"
rdr on $cen_if inet proto tcp from $enernoc_ext \
    to $enernoc_cen port $enernocb_tcp -> $enernocb_lan port $enernoc_tcp
nat on $cen_if inet from $enernocb_lan to any -> $enernoc_cen

# Unpublished primary DNS service (CEN hosts the name servers
cendns_ext="{ 67.218.95.0/24 , 207.210.151.0/24 , 159.247.233.2 , 159.247.233.18 , 207.210.132.35 }"
cendns_cen=$vendor_cen
cendns_lan="172.30.0.4"
cendns_ports="domain"
rdr on $cen_if inet proto { tcp, udp } from $cendns_ext \
    to $cendns_cen port $cendns_ports -> $cendns_lan
nat on $cen_if inet from $cendns_lan to any -> $cendns_cen


# IT Solutions - allow access to FM staging
# NOTE: These ports also allow access to the production server!
# http://help.filemaker.com/app/answers/detail/a_id/6427/~/filemaker-server-and-filemaker-server-advanced-port-numbers
its_ext="{ 74.94.63.16/29 , 173.13.234.69 , 76.99.3.11 , 96.61.95.250 }"
its_cen=$vendor_cen
its_client_lan="172.30.0.117"
its_client_ports="{ 22, 5900, 80, 5003, 16000, 16001, 16016, 16018, 2399, 16020, 16021 }"
rdr on $cen_if inet proto tcp from $its_ext \
    to $its_cen port \
       $its_client_ports -> $its_client_lan
nat on $cen_if inet from $its_client_lan \
    to $its_ext -> $its_cen


# Sirius (Suffield Summer Server)
sirius_lan="172.30.0.70"
sirius_cen="72.10.118.20"
sirius_tcp="{ www }"
#sirius_udp="{  }"
binat on $cen_if inet from $sirius_lan to any -> $sirius_cen

# habs.org
habs_lan="172.30.0.94"
habs_cen="72.10.118.21"
habs_tcp="{ www }"
binat on $cen_if inet from $habs_lan to any -> $habs_cen

# ullramassoc.com
ullramassoc_lan="172.30.0.95"
ullramassoc_cen="72.10.118.22"
ullramassoc_tcp="{ www }"
binat on $cen_if inet from $ullramassoc_lan to any -> $ullramassoc_cen

# wnessla.org
wnessla_lan="172.30.0.96"
wnessla_cen="72.10.118.23"
wnessla_tcp="{ www }"
binat on $cen_if inet from $wnessla_lan to any -> $wnessla_cen

# wmloa.org
wmloa_lan="172.30.0.97"
wmloa_cen="72.10.118.24"
wmloa_tcp="{ www }"
binat on $cen_if inet from $wmloa_lan to any -> $wmloa_cen

# Stagolee SMTP / antispam
stagolee_lan="172.30.0.28 "
stagolee_cen="72.10.118.25"
stagolee_tcp="{ http , https , smtp }"
binat on $cen_if inet from $stagolee_lan to any -> $stagolee_cen

# Barracuda remote management
barracuda_ext="{ 216.129.105.0/24, 216.129.125.192/26, 205.158.110.0/25, 64.235.144.0/20, 74.217.37.0/24 }"
barracuda_cen=$stagolee_cen
barracuda_lan=$stagolee_lan
barracuda_ports="{ 22, 8000 }"
rdr on $cen_if inet proto tcp from $barracuda_ext \
    to $barracuda_cen port $barracuda_ports -> $barracuda_lan
nat on $cen_if inet from $barracuda_lan to any -> $barracuda_cen


# CAISLists (mailman listserver)
caislists_lan="172.30.0.15"
caislists_cen="72.10.118.27"
caislists_tcp="{ http , https , smtp }"
binat on $cen_if inet from $caislists_lan to any -> $caislists_cen

# CTCSTA (web/mail)
ctcsta_lan="172.30.0.20"
ctcsta_cen="72.10.118.28"
ctcsta_tcp="{ http , https , smtp , ssh }"
binat on $cen_if inet from $ctcsta_lan to any -> $ctcsta_cen

##
## Default NAT (first match wins)
##

# Send all web traffic out a single IP address
#nat on $cen_if inet proto tcp from { <suffield_lan> } \
#                           to any port $web_ports -> $web_nat


#nat on $cen_if inet from { <netadmin> } to any -> \
#                           <nat_netadmin> round-robin sticky-address

#nat on $cen_if inet from { <dmz> } to any -> \
#                           <nat_dmz> round-robin sticky-address

#nat on $cen_if inet from { <facstaff> } to any -> \
#                           <nat_facstaff> round-robin sticky-address

#nat on $cen_if inet from { <student> } to any -> \
#                           <nat_student> round-robin sticky-address

#nat on $cen_if inet from { <guest> } to any -> \
#                           <nat_guest> round-robin sticky-address

# Default: NAT to our round-robin pool (record translation address)
nat on $cen_if inet from { <suffield_lan> } to any -> \
                           <nat_default> round-robin sticky-address


##
## Honeypot (redirect commonly attacked ports to tarpit them)
##

# ignore ssh honeypot for hosts that actually use ssh
no rdr on $cen_if inet proto tcp from any to \
   { $tessa_cen , $vader_cen , $omicron_cen , $ctcsta_cen , $gordon_cen , $reba_cen } port 22

# send ssh and ms-domain requests to discard port
rdr on $cen_if inet proto tcp from any to any port { 22 , 445 } \
    -> 127.0.0.1 port 6666



###########################################################################
###                          Packet Filtering                           ###
###########################################################################


# Note: Filter rules are applied AFTER redirection and NAT, so all
# source/destinations should be specified according to what they would
# be after translation takes place.


#
# Honeypot and blacklists
#

# blocked traffic remains until you manually expire them out:
# pfctl -t portscanners -T expire 86400 (expires all blocked older than 1 day)
# ADD A CRON JOB to do this!
block in log quick from <portscanners> to any

# Any redirected "honeypot" traffic is garbage, so be agressive about
# blacklisting this traffic.
pass quick inet proto tcp from ! <portscanners_exempt> \
     to 127.0.0.1 port 6666 keep state \
     (max-src-conn-rate 3/60, overload <portscanners> flush global)

# Blacklist hosts that try to connect to legitimate SSH servers
# more than 5 times a minute over several minutes
# jhealy: disabled as this was killing regular users
#pass quick inet proto tcp from ! <portscanners_exempt> to \
#     { $tessa_lan , $vader_lan , $omicron_lan , $ctcsta_lan } \
#     port ssh keep state \
#     (max-src-conn-rate 10/120, overload <portscanners> flush global)



##
## Failsafe permits
##

# Always allow CARP advertisements
pass quick on { $lan_if , $cen_if } proto carp keep state (no-sync)

# Allow network administrator access to SSH
pass in quick on $lan_if proto tcp \
    from <netadmin> to $fw_ip port ssh keep state (no-sync)

# Allow SNMP access
pass in quick on $lan_if proto udp \
    from <snmp> to $fw_ip port snmp keep state (no-sync)


##
## Bogus/Evil packets
##

# immediately drop and log packets that are clearly not valid
block in log quick from <bogus> to any

# don't accept packets with our internal addresses on the external interface
block in log quick on !$lan_if from <suffield_lan> to any

# ignore inbound traffic that's not for us (don't even bother logging)
block in quick from any to <bogus>


##
## Default policy
##

# block and log by default
block in log all tag $reject
block out log all tag $reject

# allow ICMP to everyone (in our case, this covers binat machines)
pass inet proto icmp \
     tag $accept

##
## Firewall-sourced connections
##

# don't label this rule -- it will generate a rule for every virtual ip
# the firewall listens on...
pass out from self tag $accept


##
## DMZ Hosts (Be sure to add to Translation section above as well)
##

# Note: ICMP is allowed to all machines in the "default policy" section
#       above, so you only need to explicitly allow TCP, UDP, etc.

# Sample (jhealy: don't use "synproxy state"; appears to be broken)
#pass inet proto tcp from any to $sample_lan port $sample_tcp \
#     tag $accept
#pass inet proto udp from any to $sample_lan port $sample_udp \
#     tag $accept

# Happitek (vagn's host)
pass inet proto tcp from any to $happitek_lan port $happitek_tcp \
     tag $accept
#pass inet proto udp from any to $happitek_lan port $happitek_udp \
#     tag $accept

# Biblio (library website)
pass inet proto tcp from any to $biblio_lan port $biblio_tcp \
     tag $accept
#pass inet proto udp from any to $biblio_lan port $biblio_udp \
#     tag $accept

# Luke (LDAP/Kerberos)
pass inet proto tcp from any to $luke_lan port $luke_tcp \
     tag $accept
pass inet proto udp from any to $luke_lan port $luke_udp \
     tag $accept

# Leia (LDAP/Kerberos)
pass inet proto tcp from any to $leia_lan port $leia_tcp \
     tag $accept
pass inet proto udp from any to $leia_lan port $leia_udp \
     tag $accept
pass inet proto gre from any to $leia_lan \
     tag $accept

# Werner (VPN)
pass inet proto tcp from any to $werner_lan port $werner_tcp \
     tag $accept
pass inet proto udp from any to $werner_lan port $werner_udp \
     tag $accept
pass inet proto gre from any to $werner_lan \
     tag $accept

# Jamaica (Aruba master controller address for Remote AP deployment)
#pass inet proto tcp from any to $jamaica_lan port $jamaica_tcp \
#     tag $accept
pass inet proto udp from any to $jamaica_lan port $jamaica_udp \
     tag $accept
pass inet proto gre from any to $jamaica_lan \
     tag $accept

# Emma (FileMaker)
pass inet proto tcp from any to $emma_lan port $emma_tcp \
     tag $accept
# also allow access to the server from our FM consultants
pass inet proto tcp from $its_ext to $emma_lan port $its_client_ports \
     tag $accept

# Tessa (File Server)
pass inet proto tcp from any to $tessa_lan port $tessa_tcp \
     tag $accept

# Marion (Library Catalog / Streaming Server)
pass inet proto tcp from any to $marion_lan port $marion_tcp \
     tag $accept
pass inet proto udp from any to $marion_lan port $marion_udp \
     tag $accept

# Omicron (Jason's web server)
pass inet from any to $omicron_lan tag $accept
# only allow SMTP via Barracuda
block inet proto tcp from any to $omicron_lan port 25 tag $reject

# Gordon (FirstClass Core)
pass inet proto tcp from any to $gordon_lan port $gordon_tcp \
     tag $accept
pass inet proto udp from any to $gordon_lan port $gordon_udp \
     tag $accept

# Reba (FirstClass Inet Svcs)
pass inet proto tcp from any to $reba_lan port $reba_tcp \
     tag $accept

# Cliff (mailman listserver)
pass inet proto tcp from any to $cliff_lan port $cliff_tcp \
     tag $accept

# Vader (Netadmin VPN / ssh)
pass inet proto tcp from any to $vader_lan port $vader_tcp \
     tag $accept
pass inet proto udp from any to $vader_lan port $vader_udp \
     tag $accept
pass inet proto gre from any to $vader_lan \
     tag $accept

# Aragog (WWW: web, library, sphereschools)
pass inet proto tcp from any to $aragog_lan port $aragog_tcp \
     tag $accept

# Dumbledore (WWW: moodle)
pass inet proto tcp from any to $dumbledore_lan port $dumbledore_tcp \
     tag $accept

# RT (WWW: help / request tracker)
pass inet proto tcp from any to $rt_lan port $rt_tcp \
     tag $accept

# pr0n (ELF Sharing)
pass inet proto tcp from any to $pr0n_lan port $pr0n_tcp \
     tag $accept

# Austin (WWW: mojolicious)
pass inet proto tcp from any to $austin_lan port $austin_tcp \
     tag $accept

# Luigi (Game server: armagetron, bzFlag, teamspeak)
pass inet proto tcp from any to $luigi_lan port $luigi_tcp \
     tag $accept
pass inet proto udp from any to $luigi_lan port $luigi_udp \
     tag $accept

# Yakko (NTP server)
pass inet proto tcp from any to $yakko_lan port $yakko_tcp \
     tag $accept
pass inet proto udp from any to $yakko_lan port $yakko_udp \
     tag $accept

# Wakko (NTP server)
pass inet proto tcp from any to $wakko_lan port $wakko_tcp \
     tag $accept
pass inet proto udp from any to $wakko_lan port $wakko_udp \
     tag $accept

# Dot (NTP server)
pass inet proto tcp from any to $dot_lan port $dot_tcp \
     tag $accept
pass inet proto udp from any to $dot_lan port $dot_udp \
     tag $accept

# Nikko (Munki repository)
pass inet proto tcp from any to $nikko_lan port $nikko_tcp \
     tag $accept

# Martin (network provisioning)
pass inet proto tcp from any to $martin_lan port $martin_tcp \
     tag $accept


##
## Vendor IPs (restricted and shared) 
##

# SNE Building Management Server
pass inet proto tcp from $snebms_ext to $snebms_lan port $snebms_tcp \
     tag $accept

# ABS Building Management Server
pass inet proto tcp from $absbms_ext to $absbms_lan port $absbms_tcp \
     tag $accept

# IGX pro-vision
pass inet proto tcp from $igxpv_ext to $igxpv1_lan port $igxpv_tcp \
     tag $accept
pass inet proto tcp from $igxpv_ext to $igxpv2_lan port $igxpv_tcp \
     tag $accept
pass inet proto tcp from $igxpv_ext to $igxkvm1_lan port $igxkvm_tcp \
     tag $accept
pass inet proto tcp from $igxpv_ext to $igxkvm2_lan port $igxkvm_tcp \
     tag $accept

# IPerf performance testing
pass inet proto { tcp , udp } from any to $iperf_lan port $iperf_ports \
     tag $accept

# Enernoc (generator monitoring)

# Library generator
pass inet proto tcp from $enernoc_ext to $enernocl_lan port $enernoc_tcp \
     tag $accept

# Brewster generator
pass inet proto tcp from $enernoc_ext to $enernocb_lan port $enernoc_tcp \
     tag $accept

# Unpublished primary DNS
pass inet proto { tcp , udp } from $cendns_ext to $cendns_lan port $cendns_ports \
     tag $accept

# IT Solutions
pass inet proto tcp from $its_ext to $its_client_lan \
     port $its_client_ports \
     tag $accept

# Sirius
pass inet proto tcp from any to $sirius_lan port $sirius_tcp \
     tag $accept
#pass inet proto udp from any to $sirius_lan port $sirius_udp \
#     tag $accept

# habs.org
pass inet proto tcp from any to $habs_lan port $habs_tcp \
     tag $accept

# ullramassoc.com
pass inet proto tcp from any to $ullramassoc_lan port $ullramassoc_tcp \
     tag $accept

# wnessla.org
pass inet proto tcp from any to $wnessla_lan port $wnessla_tcp \
     tag $accept

# wmloa.org
pass inet proto tcp from any to $wmloa_lan port $wmloa_tcp \
     tag $accept

# Stagolee SMTP
pass inet proto tcp from any to $stagolee_lan port $stagolee_tcp \
     tag $accept
# Barracuda management
pass inet proto tcp from $barracuda_ext to $barracuda_lan port $barracuda_ports \
     tag $accept

# CAISLists (mailman listserver)
pass inet proto tcp from any to $caislists_lan port $caislists_tcp \
     tag $accept

# CTCSTA (web/mail server)
pass inet proto tcp from any to $ctcsta_lan port $ctcsta_tcp \
     tag $accept


##
## Final Cleanup
##

#
# NAT hosts
#

# Allow anyone on the LAN to communicate to initiate connections to the
# outside (except as overridden below); log connections for analysis
pass in on $lan_if from <suffield_lan> to !<suffield_lan> \
     tag $accept

# We use "inet" to only pass IPv4 for now
pass out on $cen_if inet from <nat_default> \
     tag $accept

pass out on $cen_if inet proto tcp from $web_nat port $web_ports \
     tag $accept

# Block outgoing SMTP for non-trusted servers
#block out log on $cen_if proto tcp from <nat_facstaff> port smtp \
#      tag $reject
block out log on $cen_if proto tcp from <nat_default> port smtp \
      tag $reject


# allow our network to emit all the traffic it wants...
pass in tagged $accept
pass out tagged $accept
pass out on $cen_if from <suffield_wan> to any
