#################################################################
# macro definitions
ext_if = "dc0"
ext_if2 = "dc1"
ext_gw = "proper.gateway"
ext_gw2 = "same.gateway-also.correct"
int_if = "re0"
dmz1_if = "re0"
tcp_services = "{ 22, 113 }"
icmp_types = "echoreq"
web_server = "10.8.8.8"
#################################################################
# options: "set"
set block-policy return
set loginterface $ext_if
set skip on lo
#################################################################
# scrub rules: "scrub"
scrub in
#################################################################
# NAT rules: "rdr", "nat", "binat"
nat on $ext_if from 10.8.8.0/24 to any -> ($ext_if)
nat on $ext_if2 from 10.8.8.0/24 to any -> ($ext_if2)
nat-anchor "ftp-proxy/*"
# Catch stuff and send it to ftp-proxy
rdr-anchor "ftp-proxy/*"
rdr on $int_if proto tcp from any to any port { 21, 2121, 2100, 8888, 1999} -> 127.0.0.1 port 8021
# Redirect web traffic to web_server
rdr on $ext_if proto tcp from any to any port 80 -> $web_server
#################################################################
# filtering rules: "antispoof", "block", "pass"
block in
anchor "ftp-proxy/*"
# Spoofed Address Protection
antispoof quick for { lo $int_if }
pass out on $int_if from any to 10.8.8.0/24
pass in on $ext_if inet proto tcp from any to ($ext_if) port $tcp_services flags S/SA keep state
pass in quick on $int_if from 10.8.8.0/24 to $int_if
# Pass Traffic to web_server
pass in on $ext_if inet proto tcp from any to $web_server port 80 flags S/SA synproxy state
pass in inet proto icmp all icmp-type $icmp_types keep state
# Quickly pass all internal traffic (assumed good)
#pass in quick on $int_if
pass in on $int_if route-to { ($ext_if $ext_gw), ($ext_if2 $ext_gw2) } round-robin proto tcp from 10.8.8.0/24 to any flags S/SA modulate state
pass in on $int_if route-to { ($ext_if $ext_gw), ($ext_if2 $ext_gw2) } round-robin proto { udp, icmp } from 10.8.8.0/24 to any keep state
# general "pass out" rules for external interfaces
pass out on $ext_if proto tcp from any to any flags S/SA modulate state
pass out on $ext_if proto { udp, icmp } from any to any keep state
pass out on $ext_if2 proto tcp from any to any flags S/SA modulate state
pass out on $ext_if2 proto { udp, icmp } from any to any keep state
pass out on $ext_if route-to ($ext_if2 $ext_gw2) from $ext_if2 to any
pass out on $ext_if2 route-to ($ext_if $ext_gw) from $ext_if to any