ext_if = "tun0"
int_if = "sis1"
lan_net = "192.168.38.0/24"
set skip on lo0
set block-policy drop
set limit { states 8192, frags 4096}
set optimization conservative
scrub in all
scrub out all
scrub reassemble tcp
nat on $ext_if from $lan_net to any -> ($ext_if)
nat-anchor "ftp-proxy/*"
rdr-anchor "ftp-proxy/*"
rdr pass on $int_if proto tcp to port ftp -> 127.0.0.1 port 8021
## default deny
block in
# activate spoofing protection for the internal interface and loopback.
antispoof quick for { lo $int_if }
pass out keep state
anchor "ftp-proxy/*"
pass quick on $int_if keep state