## 1 - Macros ##
ext_if = "tun0"
int_if = "sis1"
icmp_types="echoreq"
## 2 - Tables ##
## 3 - Options ##
set skip on lo0
set block-policy drop
set limit { states 8192, frags 4096}
set optimization conservative
## 4 - Scrub ##
scrub in all
scrub out all
scrub reassemble tcp
## 5 - Queueing ##
## 6 - Translation ##
nat on $ext_if from $int_if to any -> ($ext_if)
rdr-anchor "ftp-proxy/*"
rdr pass on $int_if proto tcp to port ftp -> 127.0.0.1 port 8021
## 7 - Filter Rules ##
## default deny
block in
# activate spoofing protection for the internal interface and loopback.
antispoof quick for { lo $int_if }
pass out keep state
anchor "ftp-proxy/*"
pass in inet proto icmp all icmp-type $icmp_types keep state
pass quick on $int_if