fxp1 = 192.168.10.1
####################
#### Variables #####
####################
External="fxp0"
Internal="fxp1"
Loop="lo0"
NoRoute= "{ 0.0.0.0/8, 10.0.0.0/8, 127.0.0.0/8, 20.20.20.0/24, 169.254.0.0/16,
172.16.0.0/12, 192.0.2.0/24, 192.168.0.0/16, 224.0.0.0/3,
255.255.255.255 }"
icmp_types = "{ 0, 3, 4, 8, 11, 12 }"
####################################
#### Options and Optimizations #####
####################################
set loginterface $External
set optimization aggressive
set limit { frags 2500, states 5000 }
set block-policy return
#######################
#### Normalization ####
#######################
scrub in on $External all no-df
#############
#### NAT ####
#############
nat on $External inet from 192.168.10.0/24 to any -> ($External)
nat-anchor "pftpx/*"
rdr-anchor "pftpx/*"
rdr on $Internal inet proto tcp from any to any port 21 -> 127.0.0.1 port 8021
######################
#### Portforwards ####
######################
rdr on $External inet proto tcp from any to any port 20001 -> 192.168.10.10 port 20001
anchor "pftpx/*"
##############################
#### Loopback Interfance #####
##############################
pass in quick on $Loop all keep state
pass out quick on $Loop all keep state
#############################
#### Internal interface #####
#############################
pass in quick on $Internal all keep state
pass out quick on $Internal all keep state
##################################
#### External interface (In) #####
##################################
block in quick on $External from $NoRoute to any
pass in on $External proto tcp from any to $External port 20001 keep state
pass in on $External inet proto udp from any to $External port 67 keep state
pass in on $External inet proto udp from any to $External port 68 keep state
pass in on $External inet proto tcp from any to $External port > 1024 user proxy keep state
pass in on $External inet proto icmp all icmp-type $icmp_types keep state
block in on $External all
##################################
#### External interface (Out) ####
##################################
block out on $External from any to $NoRoute
pass out quick on $External inet proto udp from any to any port 53 keep state
pass out quick on $External inet proto tcp from any to any port 80 flags S/SA keep state
pass out quick on $External inet proto tcp from any to any port 21 keep state
pass out quick on $External inet proto tcp from any to any user proxy flags S/SA keep state
pass out quick on $External inet proto tcp from any to any port 443 keep state
pass out quick on $External inet proto tcp from any to any port 25 keep state
pass out quick on $External inet proto tcp from any to any port 110 keep state
pass out quick on $External proto udp from $External to any port 67 keep state
pass out quick on $External proto udp from $External to any port 68 keep state
pass out quick on $External inet proto icmp all icmp-type $icmp_types keep state queue q_prio
block out on $External all