wan_if = "pppoe0"
lan_if = "vlan0"

# silent is default
set block-policy return

scrub in all
scrub out on pppoe0 max-mss 1440

altq on $lan_if cbq bandwidth 99Mb queue { lan, nat_in }
	queue lan bandwidth 90Mb cbq(default)
	queue nat_in bandwidth 5Mb cbq { bulk_in, quick_in }
		queue bulk_in bandwidth 80% { fallback_in, web_in }
			queue fallback_in bandwidth 50% cbq(borrow red) priority 0
			queue web_in bandwidth 50% cbq(borrow red)
		queue quick_in bandwidth 20% cbq(borrow) priority 2

altq on $wan_if priq bandwidth 600Kb queue { fallback_out, web_out, ssh_out, dns_out, voip_out, ack_out }
	queue fallback_out priq(default red)
	queue web_out priq(red) priority 2
	queue ssh_out priority 3
	queue dns_out priority 4
	queue voip_out priority 5
	queue ack_out priority 6

nat on $wan_if from $lan_if:network -> ($wan_if)

nat-anchor "ftp-proxy/*"
rdr-anchor "ftp-proxy/*"
rdr on $lan_if proto tcp to !$lan_if:network port { ftp, 42 } -> 127.0.0.1 port 8021

rdr on $wan_if proto { tcp udp } to ($wan_if) port 56700:56900 -> aminal.lan
rdr on $wan_if proto { tcp udp } to ($wan_if) port 57700:57900 -> maxx.lan

rdr on $wan_if proto tcp to ($wan_if) port 160 -> aminal.lan port http
rdr on $wan_if proto tcp to ($wan_if) port 44 -> aminal.lan port ssh
rdr on $wan_if proto tcp to ($wan_if) port 42 -> aminal.lan port ftp

anchor "ftp-proxy/*"

pass in quick on $lan_if
pass quick on lo

pass out on $wan_if proto { tcp udp } queue(fallback_out, ack_out)
pass out on $wan_if proto { tcp udp } to port domain queue(dns_out, ack_out)
pass out on $wan_if proto tcp to port ssh queue(fallback_out, ssh_out)
pass out on $wan_if tos 0x68 queue(voip_out, ack_out)
pass out on $wan_if tos 0xb8 queue(voip_out, ack_out)
pass out on $wan_if proto tcp to port { https http imap smtp pop3 } queue(web_out, ack_out)

# ensure SIP registrations punch holes in the firewall for long enough
# note: isn't working
pass out on $wan_if proto udp to port sip keep state(udp.multiple 3600)

pass out on $lan_if proto { tcp udp } from !$lan_if to $lan_if:network queue(fallback_in, quick_in)
pass out on $lan_if proto tcp from !$lan_if port { https http imap smtp pop3 ssh } to $lan_if:network queue(web_in, quick_in)
pass out on $lan_if proto { tcp udp } from !$lan_if port domain to $lan_if:network queue quick_in
pass out on $lan_if from !$lan_if to $lan_if:network tos 0x68 queue quick_in
pass out on $lan_if from !$lan_if to $lan_if:network tos 0xb8 queue quick_in

# block damn ssh scanners
block in quick on $wan_if proto tcp from <scanners> port ssh
pass in on $wan_if proto tcp to port ssh keep state(max-src-conn-rate 5/45, overload <scanners>)