ext_if="tun0"
int_if="xl0"
ftp_server="192.168.0.3"
comp3="192.168.0.3"

#Services allowed
tcp_services="{ 22, 21 80 }"
icmp_types="echoreq"

##Declare stuff
#vmware        = "192.168.0.5"
strykar       = "192.168.0.3"
#krishna       = "192.168.0.4"
local_net     = "192.168.0.0/24"
ssh_ports     = "{ 22 2022 }"
im_ports      = "{ 1863 5190 5222 }"
set loginterface $ext_if
set block-policy return
scrub in all fragment reassemble min-ttl 15

##QoS contd. below
altq on rl0 priq bandwidth 610Kb queue { std_out, ssh_im_out, dns_out, tcp_ack_out }
queue std_out     priq(default)
queue ssh_im_out  priority 4 priq(red)
queue dns_out     priority 5
queue tcp_ack_out priority 6

#Setup QoS and Bandwidth limiting for services
altq on xl0 cbq bandwidth 2Mb queue { std_in, ssh_im_in, dns_in, strykar_in }

queue std_in     bandwidth 1Mb cbq(default)
queue ssh_im_in  bandwidth 200Kb priority 4
queue dns_in     bandwidth 120Kb priority 5
queue strykar_in bandwidth 80Kb cbq(borrow)

#In loopback we trust
set skip on lo

#Do NAT
nat on $ext_if from !($ext_if) to any -> ($ext_if)

#For outgoing FTP connections
#nat-anchor "ftp-proxy/*"
#rdr-anchor "ftp-proxy/*"
#rdr on $int_if proto tcp from any to any port 21 -> 127.0.0.1 port 8021

#Port forward for incoming FTP server on 192.168.0.3
rdr on $ext_if proto tcp from any to any port 21 -> $ftp_server port 21
rdr on $ext_if proto tcp from any to any port 2048:2148 -> $ftp_server port 2048:2148
#rdr on $ext_if proto tcp from any to any port 80 -> 192.168.0.2 port 80
block in

pass out keep state

#For incoming FTP connections
anchor "ftp-proxy/*"
antispoof quick for { lo $int_if }

pass in on tun0 proto tcp from any to xl0 port www flags S/SA synproxy state
#pass in on $ext_if inet proto tcp from any to ($ext_if) port $tcp_services flags S/SA keep state
#pass in on $ext_if inet proto tcp from any to xl0 port 80 flags S/SA synproxy state


pass in inet proto icmp all icmp-type $icmp_types keep state

pass in quick on $int_if

# in on $ext_if for FTP server
pass in quick on $ext_if proto tcp from any to $ftp_server port 21 keep state
pass in quick on $ext_if proto tcp from any to $ftp_server port > 2047 keep state

# out on $int_if for FTP server
pass out quick on $int_if proto tcp from any to $ftp_server port 21 keep state
pass out quick on $int_if proto tcp from any to $ftp_server port > 2047 keep state