### set these to your outside interface network and netmask and ip
oif="fxp1"
onet="192.168.0.0"
omask="255.255.255.0"
oip="192.168.0.124"
onet6="fe80::"
oprefixlen6="64"
oip6="fe80::202:b3ff:fe0a:c30e"

### set these to your inside interface network and netmask and ip
iif="fxp0"
inet="192.168.1.0"
imask="255.255.255.0"
iip="192.168.1.1"
inet6="2001:2f8:22:802::"
iprefixlen6="64"
iip6="2001:2f8:22:802::1"

fwcmd="/sbin/ipfw"

### reset firewall rules
$fwcmd -q -f flush

### divert packet to NATD 
$fwcmd add 1 divert natd ip4 from any to any via ${oif}

### Stop spoofing
$fwcmd add deny all from ${inet}:${imask} to any in via ${oif}
$fwcmd add deny all from ${onet}:${omask} to any in via ${iif}

### Allow from / to myself
$fwcmd add pass all from me to any
$fwcmd add pass all from any to me

### Allow DNS queries out in the world
### (if DNS is on localhost, delete passDNS)
$fwcmd add pass udp from any 53 to any
$fwcmd add pass udp from any to any 53
$fwcmd add pass tcp from any to any 53
$fwcmd add pass tcp from any 53 to any

### Allow RA RS NS NA Redirect...
$fwcmd add pass ipv6-icmp from any to any

# Allow IP fragments to pass through
$fwcmd add pass all from any to any frag

# Allow RIPng
$fwcmd add pass udp from fe80::/10 521 to ff02::9 521
$fwcmd add pass udp from fe80::/10 521 to fe80::/10 521

############Taggged rules############################
## Opengate add following rules after authentication (at Layer2 check)
## (Need 'net.link.ether.ipfw=1' in /etc/sysctl.conf to enable L2 check)
##   count tag 123 ip from any to any MAC any <CliMac> keep-state via ..
##   count tag 123 ip from any to any MAC <CliMac> any keep-state via ..
## 123 : Can be set as IpfwTagNumber of opengatesrv.conf
## <CliMac> :MAC address of authenticated client

$fwcmd add 60000 allow ip from any to any tagged 123

################################################

## At L2 check, throw all packets to L3 check after tagged
$fwcmd add 60010 pass ip from any to any MAC any any

### Forwarding IPv4 http connection from unauth client 
$fwcmd add 60100 fwd localhost tcp from ${inet}:${imask} to any 80
$fwcmd add 60100 fwd localhost tcp from ${inet}:${imask} to any 443

### Allow http reply for forwarded request 
### (it is sent out from localhost but has original source address)
$fwcmd add 60110 pass tcp from any 80 to any out
$fwcmd add 60120 pass tcp from any 443 to any out

# TCP reset notice message for IPv6 http connection
$fwcmd add 60130 reset tcp from any to any 80
$fwcmd add 60140 reset tcp from any to any 443


