scrub on rl0 all
priv_nets="{ 127.0.0.0/8 , 192.168.0.0/16 , 172.16.0.0/12  }"
table <banned_ip> persist file "/var/config/firewall/banned"
table <spyware> persist file "/var/config/firewall/spyware"

altq on rl0 hfsc bandwidth 250Kb queue { default_o, laptop_o}
queue default_o bandwidth 128Kb hfsc ( realtime 128Kb linkshare 10% upperlimit 250Kb default )
queue laptop_o bandwidth 64Kb hfsc ( realtime 64Kb linkshare 5Kb  upperlimit 64Kb )

altq on vr0 hfsc bandwidth 103350Kb queue { lan_vr0_in, down_vr0_in}
queue lan_vr0_in bandwidth 102400Kb hfsc ( linkshare 10% upperlimit 102400Kb default )
queue down_vr0_in bandwidth 950Kb hfsc ( realtime 128Kb upperlimit 950Kb ) {laptop_i}
queue laptop_i bandwidth 128Kb hfsc ( realtime 128Kb linkshare 5Kb  upperlimit 128Kb )


        nat on rl0 from { 192.168.0.1/16 } to any -> (rl0)
        rdr on vr0 proto tcp from any to !(vr0) port 21 -> 127.0.0.1 port 8021

pass quick on lo0 all

block quick from <banned_ip> to any
block quick from any to <banned_ip>

block quick from <spyware> to any
block quick from any to <spyware>

#WAN spoof check
block in quick on rl0 from $priv_nets to any


#DHCP server in LAN
pass in quick on { vr0 } proto udp from any port = 68 to 255.255.255.255 port = 67
pass in quick on { vr0 } proto udp from any port = 68 to { 192.168.0.1/16 } port = 67
pass out quick on { vr0 } proto udp from { 192.168.0.1/16 } port = 67 to any port = 68

#antispoof rules (need to be after DHCP rules)
antispoof quick for (rl0)
antispoof quick for (vr0)

#inbound rules

block in quick on rl0 proto tcp from any to (rl0) port 3306
block in quick on vr0 proto tcp from any to (vr0) port 3306
block in quick on rl0 proto { tcp, udp } from any to (rl0) port 8021
block in quick on vr0 proto { tcp, udp } from any to (vr0) port 8021


# laptop shaping
pass in quick on rl0 inet from 192.168.0.40 to any queue laptop_o
pass out quick on vr0 inet from any  to 192.168.0.40 queue laptop_i

pass quick on vr0 from 192.168.0.1/16 to 192.168.0.1/16 queue lan_in

pass out quick on rl0 from (rl0) to any
pass in quick on rl0 from any to (rl0)


block             out on rl0           all
block             in  on rl0           all
block return-rst  out on rl0 proto tcp all
block return-rst  in  on rl0 proto tcp all
block return-icmp out on rl0 proto udp all
block return-icmp in  on rl0 proto udp all