From 5263aa814da9852294ea64c77af22a1cd2507fca Mon Sep 17 00:00:00 2001
From: Jan Tuomi <jan@jantuomi.fi>
Date: Wed, 22 Oct 2025 22:45:15 +0300
Subject: Improvements

---
 templates/ingress/etc_pf.conf.j2 | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)
 create mode 100644 templates/ingress/etc_pf.conf.j2

(limited to 'templates/ingress/etc_pf.conf.j2')

diff --git a/templates/ingress/etc_pf.conf.j2 b/templates/ingress/etc_pf.conf.j2
new file mode 100644
index 0000000..c8045fd
--- /dev/null
+++ b/templates/ingress/etc_pf.conf.j2
@@ -0,0 +1,19 @@
+{% for jail in jails -%}
+{% if jail.name == 'ingress' -%}
+# Interfaces & nets
+lan = "epl{{ jail.num }}b"
+wan = "epw{{ jail.num }}b"
+lan_net = "{{ lan_ipv4_cidr }}"
+
+# Keep PF out of loopback, drop by default if you add blocks later
+set skip on lo0
+set block-policy drop
+
+# NAT: translate LAN traffic to the WAN interface address, and log it
+nat log on $wan from $lan_net to any -> ($wan)
+
+# Allow and log the LAN traffic so NAT can happen
+pass in  on $lan inet from $lan_net to any keep state
+pass out on $wan inet from $lan_net to any keep state
+{% endif %}
+{% endfor %}
-- 
cgit v1.3