Thanks #FreeBSD!
/etc/pf.conf:
logopt = "log"
# Interface/network specification
ext_if = "xl0" # external
elan_if = "rl0" # ethernet
wlan_if = "ath0" # wifi
lan_ifs = "{ rl0 ath0 }" # all internal interfaces
lan_net = "{ 10.0.0.0/23 }" # whole network (e+w)
# SSH
ssh_ext_port = "22"
ssh_srv = "10.0.0.1 port 22"
# HTTP
http_ext_port = "80"
http_srv = "127.0.0.1 port 80"
############################################################
# Everything below this point is routing commands, e.g.
# nothing that is configured by the variables above.
############################################################
# GENERAL CONFIGURATION
# Options that are not associated with overall network
# traffic flow.
############################################################
# Keep loopback interfaces on the local machine free of pf
# overhead.
#set skip on lo
# Keep logs of traffic on the external interface.
set loginterface $ext_if
# NAT
nat on $ext_if from $lan_ifs to any -> ($ext_if)
rdr on $ext_if proto tcp to port $ssh_ext_port -> $ssh_srv
rdr on $ext_if proto tcp to port $http_ext_port -> $http_srv
# TEMPORARY RULES XXX
# Let DNS contact the outside world
rdr on $ext_if proto tcp to port 53 -> 10.0.0.1 port 53
# XXX
# INTERNAL AND OUTBOUND TRAFFIC
# LAN-to-LAN and LAN-to-world traffic.
############################################################
# Allows all traffic on the LAN interfaces, so traffic is
# only stopped at $ext_if.
pass quick on $lan_ifs
# Allow all traffic to reach the outside world.
pass out quick on $ext_if keep state
# OUTSIDE WORLD TRAFFIC
# Traffic coming in from the outside world.
############################################################
# Default block policy
#block on $ext_if to $ext_if
# Allow ICMP (pinging)
pass in on $ext_if proto icmp keep state
pass in on $ext_if inet proto tcp to $ssh_srv flags S/SA synproxy state
pass in on $ext_if inet proto tcp to $http_srv flags S/SA synproxy state
pass in on $ext_if inet proto tcp to 53 flags S/SA synproxy state
# XXX temporarily open DHCP to outside world