##############################
#set our macros
##############################
ext_if="de0" #the external interface
int_if="de1" #the internal interface
internal_net="192.168.1.0/24"
ganon="192.168.1.2"
#############################
#first, normalize packets we transmit and receive
#############################
scrub in all
#############################
#then, give NAT to our internal addresses
#############################
nat on $ext_if from $internal_net to any -> ($ext_if)
#############################
# Port forwarding
#############################
# bittorrent
rdr on $ext_if proto tcp from any to any port 10000:60000 -> $ganon port 10000:60000
#############################
# Port forwarding
#############################
# bittorrent
rdr on $ext_if proto tcp from any to any port 10000:60000 -> $ganon port 10000:$
# Port forward 8889 to ganon for gnump3d
rdr on $ext_if proto tcp from any to any port 8889 -> $ganon port 8889
#We want outbound FTP to work properly, so let's enable the
#FTP proxy. Be sure you have ftp-proxy running out of inetd(8)!
rdr on $int_if proto tcp from any to any port ftp -> 127.0.0.1 port 8021
#We're not doing any packet shaping, so let's go directly to the
#packet filtering. We'll block everything first, and then only
#explicitly allow desirable traffic.
block in log all
#As our client operating systems may be running some godforsaken
#operating system with poor ISN selection, we'll use state modulation.
pass in on $int_if inet from $internal_net to any modulate state
#I'd like to be able to SSH to my network from anywhere
pass in on $ext_if inet proto tcp from any to ($ext_if) port ssh keep state
#and, don't forget to allow our ftp-proxy program to connect back to
#the firewall!
pass in on $ext_if inet proto tcp from any to ($ext_if) user proxy keep state
#pass in bittorrent
pass in on $ext_if proto tcp from any to $ganon port 10000:60000
# Pass gnump3d
pass in on $ext_if proto tcp from any to $ganon port 8889