ext_if="fxp0" # replace with actual external interface name i.e., dc0
int_if="nve0" # replace with actual internal interface name i.e., dc1
internal_net="10.100.47.0/24"
external_addr="an ip somewhere...."
#table <foo> { 10.0.0.0/8, !10.1.0.0/16, 192.168.0.0/24, 192.168.1.18 }
scrub in all
# altq based Queueing
# for the record, i disabled this because it had a nasty side effect (that i didn't pay attention to)
# which caused talking to the box this was on from the internal network to be limited to 2Mb/s
# .. which wasn't what i wanted, but hey, when you goof, that's what happens.
altq on $int_if bandwidth 2Mb cbq queue { full, limited }
queue full bandwidth 50% cbq(default borrow) priority 7
queue limited bandwidth 50% cbq priority 0
nat on $ext_if from $internal_net to any -> ($ext_if)
pass in all
pass out all
# note: pay attention to which interfaces i was playing with here.. the rules are a bit .. odd.
pass in on $ext_if proto tcp from any to $ext_if port { 80, 443 } keep state
pass out on $int_if from 204.146.27.171 to any keep state queue limited