# IPv6
linklocal6="fe80::/10"
dhcpv6_server="ff02::1:2"
routers_mcast="ff02::2"
linklocal_bcast="ff02::1"

# Solicited-node multicast address prefix, for Duplicate Address Detection (DAD)
solnode6="ff02:0:0:0:0:1:ff00::/104"

table <admin_ips> const {
<% @admin_ips.sort.each do |ip| -%>
	<%= ip %>
<% end -%>
}

set skip on lo

# Basic policy; only filter inbound
block in log all
pass out all

# Port build user does not need the network
block return out quick log proto {tcp udp} user _pbuild

## All ICMP pings
pass in quick on egress inet proto icmp all icmp-type echoreq max-pkt-rate 100/10
pass in quick on egress inet6 proto icmp6 all icmp6-type echoreq max-pkt-rate 100/10

# DHCPv6
pass in quick on egress proto udp from $linklocal6 port dhcpv6-server to $linklocal6 port dhcpv6-client
# IPv6 Router advertisement and neighbor discovery (see RFC 4890 for recommendations)
pass in quick on egress inet6 proto icmp6 from $linklocal6 to $linklocal_bcast icmp6-type routeradv
pass in quick on egress inet6 proto icmp6 from any to { $linklocal6, $solnode6, egress } icmp6-type { neighbrsol, neighbradv }

# SSH
pass in quick on egress proto tcp from <admin_ips> to egress port 22

# Certes
pass in quick on egress proto tcp from any to egress port 9790

<% if @external_authoritative_dns -%>
# Authoritative DNS
pass in quick on egress inet proto {tcp,udp} from any to egress port 53 rdr-to 127.0.0.1 port 853 keep state (max-src-conn-rate 100/10)
pass in quick on egress inet6 proto {tcp,udp} from any to egress port 53 rdr-to ::1 port 853 keep state (max-src-conn-rate 100/10)
pass in quick on egress proto {tcp,udp} from any to egress port 853 keep state (max-src-conn-rate 100/10)
<% end -%>
