wan_if = "pppoe0"
lan_if = "vlan0"
# silent is default
set block-policy return
scrub in all
scrub out on pppoe0 max-mss 1440
altq on $lan_if cbq bandwidth 99Mb queue { lan, nat_in }
queue lan bandwidth 90Mb cbq(default)
queue nat_in bandwidth 5Mb cbq { bulk_in, quick_in }
queue bulk_in bandwidth 80% { fallback_in, web_in }
queue fallback_in bandwidth 50% cbq(borrow red) priority 0
queue web_in bandwidth 50% cbq(borrow red)
queue quick_in bandwidth 20% cbq(borrow) priority 2
altq on $wan_if priq bandwidth 600Kb queue { fallback_out, web_out, ssh_out, dns_out, voip_out, ack_out }
queue fallback_out priq(default red)
queue web_out priq(red) priority 2
queue ssh_out priority 3
queue dns_out priority 4
queue voip_out priority 5
queue ack_out priority 6
nat on $wan_if from $lan_if:network -> ($wan_if)
nat-anchor "ftp-proxy/*"
rdr-anchor "ftp-proxy/*"
rdr on $lan_if proto tcp to !$lan_if:network port { ftp, 42 } -> 127.0.0.1 port 8021
rdr on $wan_if proto { tcp udp } to ($wan_if) port 56700:56900 -> aminal.lan
rdr on $wan_if proto { tcp udp } to ($wan_if) port 57700:57900 -> maxx.lan
rdr on $wan_if proto tcp to ($wan_if) port 160 -> aminal.lan port http
rdr on $wan_if proto tcp to ($wan_if) port 44 -> aminal.lan port ssh
rdr on $wan_if proto tcp to ($wan_if) port 42 -> aminal.lan port ftp
anchor "ftp-proxy/*"
pass in quick on $lan_if
pass quick on lo
pass out on $wan_if proto { tcp udp } queue(fallback_out, ack_out)
pass out on $wan_if proto { tcp udp } to port domain queue(dns_out, ack_out)
pass out on $wan_if proto tcp to port ssh queue(fallback_out, ssh_out)
pass out on $wan_if tos 0x68 queue(voip_out, ack_out)
pass out on $wan_if tos 0xb8 queue(voip_out, ack_out)
pass out on $wan_if proto tcp to port { https http imap smtp pop3 } queue(web_out, ack_out)
# ensure SIP registrations punch holes in the firewall for long enough
# note: isn't working
pass out on $wan_if proto udp to port sip keep state(udp.multiple 3600)
pass out on $lan_if proto { tcp udp } from !$lan_if to $lan_if:network queue(fallback_in, quick_in)
pass out on $lan_if proto tcp from !$lan_if port { https http imap smtp pop3 ssh } to $lan_if:network queue(web_in, quick_in)
pass out on $lan_if proto { tcp udp } from !$lan_if port domain to $lan_if:network queue quick_in
pass out on $lan_if from !$lan_if to $lan_if:network tos 0x68 queue quick_in
pass out on $lan_if from !$lan_if to $lan_if:network tos 0xb8 queue quick_in
# block damn ssh scanners
block in quick on $wan_if proto tcp from <scanners> port ssh
pass in on $wan_if proto tcp to port ssh keep state(max-src-conn-rate 5/45, overload <scanners>)