# Interfaces
wan="rl0"
lan="fxp0"
#wifi="fxp1"
# Hosts
thermopylae="172.31.1.1"
r1="172.31.1.2"
r2="172.31.1.3"
juniper="172.31.1.4"
eclipse="172.31.1.101"
aspie="172.31.1.102"
wrt="192.168.200.1"
# Protocols
ftp_ports="{ 21, 989, 990 }"
tcp_ports="{ 113, 873 }"
udp_ports="{ 873 }"
set block-policy return
set loginterface $wan
set skip on lo
scrub in log (all) all
nat on $wan from !($wan) to any -> ($wan)
nat-anchor "ftp-proxy/*"
rdr-anchor "ftp-proxy/*"
rdr on $lan proto tcp from any to any port $ftp_ports -> 127.0.0.1 port 8021
block in log (all) on $wan all
#block in log (all) on $wifi all
pass out log (all) all keep state
anchor "ftp-proxy/*"
#antispoof quick for { lo, $lan, $wifi }
pass in log (all) inet proto tcp from any to any port ssh keep state queue(ssh_bulk, ssh_interactive)
pass in log (all) inet proto tcp from any to any port $tcp_ports keep state
pass in log (all) inet proto udp from any to any port $udp_ports keep state
pass in log (all) inet proto icmp all icmp-type echoreq keep state
pass in log (all) quick on $lan