openbsd+pf配置

　　/etc/pf/pf2.conf如下

　　ext_if="rl0" #接公网
192_if="rl1" #接内网段1
131_if="rl2" #接内网段2
192net="{
192.168.1.2/32,
192.168.1.8/32,
192.168.1.6/32,
192.168.1.45/32,
192.168.1.47/32,
192.168.1.16/32,
192.168.1.28/32,
192.168.1.249/32,
192.168.1.222/32
}"
131net="{
131.107.3.48/32,
131.107.3.47/32
}"
tcp_services="{22,113}"
icmp_types="echoreq"
priv_nets="{127.0.0.0/8,192.168.0.0/16,172.16.0.0/12,10.0.0.0/8}"
set optimization aggressive
scrub in all
nat on rl0 from 192.168.1.0/24 to any -> 61.131.58.x/32
nat on rl0 from 131.107.3.0/24 to any -> 61.131.58.X/32
block all
pass quick on lo0 all
block drop in quick on $ext_if from $priv_nets to any
block drop out quick on $ext_if from any to $priv_nets
#pass in inet proto icmp all icmp-type $icmp_types keep states
block in quick on $192_if from 131.107.3.0/24 to any
block out quick on $192_if from any to 131.107.3.0/24
block in quick on $131_if from 192.168.1.0/24 to any
block out quick on $131_if from any to 192.168.1.0/24
pass in on $192_if from $192net to any keep state
pass out on $192_if from any to $192net keep state
pass in on $131_if from $131net to any keep state
pass out on $131_if from any to $131net keep state
pass out on $ext_if proto tcp all modulate state flags S/SA
pass out on $ext_if proto udp all keep state