# macros
int_if="fxp0"
ext_if="fxp1"
tcp_services="{ }"
icmp_services="{ echoreq }"
bt_host1="192.168.1.27"
bt_host2="192.168.1.20"
bt_port1="26012"
bt_port2="26013"
# options
set block-policy return
set loginterface $ext_if
set skip on lo
# scrub
scrub in all
# nat/rdr
nat on $ext_if from !($ext_if) -> ($ext_if:0)
nat-anchor "ftp-proxy/*"
rdr-anchor "ftp-proxy/*"
rdr pass on $int_if proto tcp to port ftp -> 127.0.0.1 port 8021
rdr on $ext_if proto { tcp, udp } from any to any port $bt_port1 -> $bt_host1
rdr on $ext_if proto { tcp, udp } from any to any port $bt_port2 -> $bt_host2
# filter rules
block in
pass out keep state
anchor "fxp-proxy/*"
antispoof quick for { lo $int_if }
# pass in on $ext_if proto tcp from any to ($ext_if) port $tcp_services flags S/
SA keep state
pass in on $ext_if proto { tcp, udp } from any to $bt_host1 port $bt_port1 flags
S/SA synproxy state
pass in on $ext_if proto { tcp, udp } from any to $bt_host2 port $bt_port2 flags
S/SA synproxy state
pass in inet proto icmp all icmp-type $icmp_services keep state
pass quick on $int_if