# macros
int_if="fxp0"
ext_if="fxp1"

tcp_services="{ }"
icmp_services="{ echoreq }"

bt_host1="192.168.1.27"
bt_host2="192.168.1.20"
bt_port1="26012"
bt_port2="26013"

# options
set block-policy return
set loginterface $ext_if

set skip on lo

# scrub
scrub in all

# nat/rdr
nat on $ext_if from !($ext_if) -> ($ext_if:0)
nat-anchor "ftp-proxy/*"
rdr-anchor "ftp-proxy/*"

rdr pass on $int_if proto tcp to port ftp -> 127.0.0.1 port 8021
rdr on $ext_if proto { tcp, udp } from any to any port $bt_port1 -> $bt_host1
rdr on $ext_if proto { tcp, udp } from any to any port $bt_port2 -> $bt_host2

# filter rules
block in

pass out keep state

anchor "fxp-proxy/*"
antispoof quick for { lo $int_if }

# pass in on $ext_if proto tcp from any to ($ext_if) port $tcp_services flags S/
SA keep state

pass in on $ext_if proto { tcp, udp } from any to $bt_host1 port $bt_port1 flags
 S/SA synproxy state
pass in on $ext_if proto { tcp, udp } from any to $bt_host2 port $bt_port2 flags
 S/SA synproxy state

pass in inet proto icmp all icmp-type $icmp_services keep state

pass quick on $int_if