ext_if="pppoe0"
int_if="we1"

# RFC1918
priv_nets = "{ 127.0.0.0/8, 192.168.0.0/24 }"

set block-policy return
set loginterface $ext_if
set skip on lo

#table <spamd> persist
#table <spamd-white> persist

scrub in
scrub out on $ext_if max-mss 1452

# NAT
nat on $ext_if proto {tcp udp icmp gre} from !($ext_if) -> ($ext_if:0)
#nat on $ext_if proto {tcp udp icmp gre} from !($ext_if) -> ($ext_if)
#nat on $ext_if proto {tcp udp icmp gre} from $int_if:network to any -> ($ext_if:0) static-port
nat-anchor "ftp-proxy/*"

# REDIRECTIONS
rdr-anchor "ftp-proxy/*"
#rdr pass on $int_if proto tcp to port ftp -> 127.0.0.1 port 8021
#rdr on $int_if proto tcp from any to any port ftp -> 127.0.0.1 port 8021

#rdr pass on $ext_if proto tcp from <spamd> to port smtp \
#       -> 127.0.0.1 port spamd
#rdr pass on $ext_if proto tcp from !<spamd-white> to port smtp \
#
rdr on $ext_if proto tcp to ($ext_if) port 4662 -> 192.168.0.101
rdr on $ext_if proto tcp to ($ext_if) port 6881 -> 192.168.0.101
rdr on $ext_if proto udp to ($ext_if) port 4444 -> 192.168.0.101
#rdr pass on $int_if proto tcp from $lan to any port 21 -> 127.0.0.1 port 8021
rdr pass on $int_if proto tcp from any to any port 21 -> 127.0.0.1 port 8021
rdr-anchor "ftp-proxy/*"

# Filtering begins
#block drop log all
#block in

# Clean invalid SRC/DST packets
#block in log quick on $ext_if from $priv_nets to any
#block out log quick on $ext_if from any to $priv_nets
pass out keep state
anchor "ftp-proxy/*"
antispoof quick for { lo $int_if }

# VPN PPTP
#VPN out from internal network
#pass in log quick on $int_if proto gre keep state
#pass in log quick on $int_if inet proto tcp from any to any port 1723 flags S/SA keep state
#pass out log quick on $ext_if proto gre keep state
#pass out log quick on $ext_if inet proto tcp from any to any port 1723 flags S/SA keep state

# Pass in allowed servers
# pass in on $ext_if proto tcp from any to ($ext_if) port ssh flags S/SA keep state
#pass in on $ext_if proto tcp to ($ext_if) port > 49151 user proxy keep state
#pass in log on $ext_if proto tcp to ($ext_if) port smtp keep state
#pass out log on $ext_if proto tcp from ($ext_if) to port smtp keep state
pass in on $ext_if inet proto tcp from port ftp-data to ($ext_if) user proxy flags S/SA keep state
pass in log quick on $ext_if inet proto tcp to 192.168.0.101 port 4662 flags S/SA keep state
pass in log quick on $ext_if inet proto tcp to 192.168.0.101 port 6881 flags S/SA keep state


# Pass in FTP proxy
#pass in on $ext_if inet proto tcp from any to $ext_if user proxy keep state
#pass in on $ext_if inet proto tcp from port ftp-data to ($ext_if) user proxy flags S/SA keep state

# Local machine stuff
pass quick on $int_if