#!/bin/sh

#wi_inet="00:0a:cd:03:34:f8 00:09:5b:2f:c1:ce 00:09:5b:3d:19:37 00:09:5b:43:20:a9 00:e0:98:ab:41:09"
PORTS="4242, 4660-4672, 6881-6889, 6347, 6257, 6699, 1214"
NFSU_PORTS="10800, 10900, 10901, 10980"

ipfw=`which ipfw`
sysctl=`which sysctl`

$ipfw -f flush
$sysctl net.link.ether.ipfw=1

$ipfw add 10 drop ip from any to any mac-type ipv6

#$ipfw add 20 fwd 127.0.0.1,3128 tcp from 192.168.0.0/24 to not me dst-port 80 via rl0

#$ipfw add 50 skipto 10000 all from any to any layer2

#Please let me in
$ipfw add deny tcp from any to any $PORTS via tun0
$ipfw add deny udp from any to any $PORTS via tun0

#Loopback traffic
$ipfw add allow all from any to any via lo0

#Wired LAN traffic
$ipfw add allow all from any to any via rl0

#ADSL Modem traffic
$ipfw add allow all from any to any via sis0

#Wireless LAN traffic
#$ipfw add allow all from any to any via rl1

#RFC 
$ipfw add drop all from 172.16.0.0/12 to any in via tun0
$ipfw add drop all from 192.168.0.0/24 to any in via tun0

#RST Ident/Scanport
$ipfw add reset tcp from any to me dst-port 113,1080,3128,6588,8080 via tun0

#Deny 
$ipfw add deny all from any to me 3000 via tun0
$ipfw add deny all from any to me 4000-4080 in via tun0
$ipfw add deny all from any to me 143 in via tun0
#NFS:U Server
$ipfw add deny all from any to me  ${NFSU_PORTS} in via tun0


#Deny SMTP traffic
$ipfw add deny tcp from any to me 25 via tun0

#Deny dummy smb traffic on tun0
$ipfw add deny all from any to any 137,138,139 via tun0
$ipfw add deny all from any 137,138,139 to any via tun0

#ICMP traffic
$ipfw add allow icmp from any to any out via tun0 icmptypes 8
$ipfw add allow icmp from any to any in via tun0 icmptypes 0

#PMTU problem (type 3 code 4)
$ipfw add allow icmp from any to any via tun0 icmptypes 3
$ipfw add deny icmp from any to any in via tun0 icmptypes 8 

#Allow pre-established connections
$ipfw add pass tcp from any to me in via tun0 keep-state
$ipfw add pass tcp from any to 192.168.0.0/24 in via tun0 keep-state

#Allow ALL LAN traffic (LAN -> out)
$ipfw add pass tcp from me to any out via tun0 setup keep-state
$ipfw add pass udp from me to any out via tun0 keep-state
$ipfw add pass tcp from 192.168.0.0/24 to any out via tun0 setup keep-state
$ipfw add pass udp from 192.168.0.0/24 to any out via tun0 keep-state

#HTTP traffic
$ipfw add pass tcp from any to me 80 in via tun0
$ipfw add pass tcp from me 80 to any out via tun0

#DNS traffic
$ipfw add allow udp from any 53 to any in 
$ipfw add allow udp from any to any 53 out 

#NTP Server
$ipfw add allow udp from any 123 to me in 
$ipfw add allow udp from me to any 123 out 

#Wireless Section
#${ipfw} add 10000 count mac any any
#for i in $wi_inet
#do
#   $ipfw add allow all from any to any MAC any $i via rl1
#   $ipfw add allow all from any to any MAC $i any via rl1
#done
#$ipfw add deny mac any any via rl1
#$ipfw add allow mac any any 

#Latest security rule!!!
$ipfw add 65000 drop all from any to any
