##############################
#set our macros
##############################

ext_if="de0"           #the external interface
int_if="de1"           #the internal interface
internal_net="192.168.1.0/24"
ganon="192.168.1.2"

#############################
#first, normalize packets we transmit and receive
#############################

scrub in all

#############################
#then, give NAT to our internal addresses
#############################

nat on $ext_if from $internal_net to any -> ($ext_if)


#############################
# Port forwarding
#############################

# bittorrent
rdr on $ext_if proto tcp from any to any port 10000:60000 -> $ganon port 10000:60000

#############################
# Port forwarding
#############################

# bittorrent
rdr on $ext_if proto tcp from any to any port 10000:60000 -> $ganon port 10000:$

# Port forward 8889 to ganon for gnump3d
rdr on $ext_if proto tcp from any to any port 8889 -> $ganon port 8889

#We want outbound FTP to work properly, so let's enable the
#FTP proxy.  Be sure you have ftp-proxy running out of inetd(8)!
rdr on $int_if proto tcp from any to any port ftp -> 127.0.0.1 port 8021

#We're not doing any packet shaping, so let's go directly to the
#packet filtering.  We'll block everything first, and then only

#explicitly allow desirable traffic.

block in log all

#As our client operating systems may be running some godforsaken
#operating system with poor ISN selection, we'll use state modulation.

pass in on $int_if inet from $internal_net to any modulate state

#I'd like to be able to SSH to my network from anywhere
pass in on $ext_if inet proto tcp from any to ($ext_if) port ssh keep state

#and, don't forget to allow our ftp-proxy program to connect back to
#the firewall!
pass in on $ext_if inet proto tcp from any to ($ext_if) user proxy keep state

#pass in bittorrent
pass in on $ext_if proto tcp from any to $ganon port 10000:60000 

# Pass gnump3d
pass in on $ext_if proto tcp from any to $ganon port 8889