ext_if="tun0"
int_if="xl0"
ftp_server="192.168.0.3"
comp3="192.168.0.3"
#Services allowed
tcp_services="{ 22, 21 80 }"
icmp_types="echoreq"
##Declare stuff
#vmware = "192.168.0.5"
strykar = "192.168.0.3"
#krishna = "192.168.0.4"
local_net = "192.168.0.0/24"
ssh_ports = "{ 22 2022 }"
im_ports = "{ 1863 5190 5222 }"
set loginterface $ext_if
set block-policy return
scrub in all fragment reassemble min-ttl 15
##QoS contd. below
altq on rl0 priq bandwidth 610Kb queue { std_out, ssh_im_out, dns_out, tcp_ack_out }
queue std_out priq(default)
queue ssh_im_out priority 4 priq(red)
queue dns_out priority 5
queue tcp_ack_out priority 6
#Setup QoS and Bandwidth limiting for services
altq on xl0 cbq bandwidth 2Mb queue { std_in, ssh_im_in, dns_in, strykar_in }
queue std_in bandwidth 1Mb cbq(default)
queue ssh_im_in bandwidth 200Kb priority 4
queue dns_in bandwidth 120Kb priority 5
queue strykar_in bandwidth 80Kb cbq(borrow)
#In loopback we trust
set skip on lo
#Do NAT
nat on $ext_if from !($ext_if) to any -> ($ext_if)
#For outgoing FTP connections
#nat-anchor "ftp-proxy/*"
#rdr-anchor "ftp-proxy/*"
#rdr on $int_if proto tcp from any to any port 21 -> 127.0.0.1 port 8021
#Port forward for incoming FTP server on 192.168.0.3
rdr on $ext_if proto tcp from any to any port 21 -> $ftp_server port 21
rdr on $ext_if proto tcp from any to any port 2048:2148 -> $ftp_server port 2048:2148
#rdr on $ext_if proto tcp from any to any port 80 -> 192.168.0.2 port 80
block in
pass out keep state
#For incoming FTP connections
anchor "ftp-proxy/*"
antispoof quick for { lo $int_if }
pass in on tun0 proto tcp from any to xl0 port www flags S/SA synproxy state
#pass in on $ext_if inet proto tcp from any to ($ext_if) port $tcp_services flags S/SA keep state
#pass in on $ext_if inet proto tcp from any to xl0 port 80 flags S/SA synproxy state
pass in inet proto icmp all icmp-type $icmp_types keep state
pass in quick on $int_if
# in on $ext_if for FTP server
pass in quick on $ext_if proto tcp from any to $ftp_server port 21 keep state
pass in quick on $ext_if proto tcp from any to $ftp_server port > 2047 keep state
# out on $int_if for FTP server
pass out quick on $int_if proto tcp from any to $ftp_server port 21 keep state
pass out quick on $int_if proto tcp from any to $ftp_server port > 2047 keep state