lan_net="192.168.1.0/24"
adsl_if="tl0"
adsl_gw="64.81.53.1"
int_if="vr0"
sdsl_if="tl1"
sdsl_gw="66.92.12.1"
game_ports = "{2302, 2303, 27015, 3724, 6112, 27016 }"
important = "{80, 8080, 4080, 5190, 5222, 25}"
bit="{6881,6882,6883,6884,6885,6886,6887,6889,6898}"


set block-policy drop
set limit states 50000
set loginterface $int_if

#Queue galore
scrub all reassemble tcp
altq on $adsl_if cbq bandwidth 700Kb qlimit 100 queue {bit,imp, else, game}
queue imp priority 7 bandwidth 50% cbq(default,ecn,borrow)
queue else priority 5 bandwidth 20% cbq(borrow)
queue bit priority 3 bandwidth 20% cbq
queue game priority 6 bandwidth 10% cbq(borrow)
altq on $sdsl_if cbq bandwidth 700Kb qlimit 100 queue {bit2, imp2, else2, game2}
queue imp2 priority 7 bandwidth 50% cbq(default,ecn,borrow)
queue bit2 priority 3 bandwidth 20% cbq
queue else2 priority 5 bandwidth 20% cbq(borrow)
queue game2 priority 6 bandwidth 10% cbq(borrow)

# nat on both interfaces from internal
nat on $adsl_if from $lan_net to any -> ($adsl_if)
nat on $sdsl_if from $lan_net to any -> ($sdsl_if)
rdr pass on $int_if proto tcp to port ftp -> 127.0.0.1 port 8021

block in from any to any
block out from any to any

# pass all outgoing packets on internal interface
pass out on $int_if from any to $lan_net
# pass in quick any packets destined for the gateway itself
pass in quick on $int_if from $lan_net to $int_if


# packet filtering
pass in on $int_if route-to \
   { ($adsl_if $adsl_gw), ($sdsl_if $sdsl_gw) } round-robin \
   proto tcp from $lan_net to any flags S/SA modulate state
pass in on $int_if route-to \
{ ($adsl_if $adsl_gw), ($sdsl_if $sdsl_gw) } round-robin \
   proto {udp, icmp} from $lan_net to any keep state

pass  out on $adsl_if inet proto tcp from any to any \
        flags S/SA modulate state queue else
pass out on $adsl_if proto { udp, icmp } from any to any keep state
pass  out on $adsl_if inet proto tcp from any to any port $game_ports \
        flags S/SA modulate state queue game
pass  out on $adsl_if inet proto tcp from any to any port $important \
        flags S/SA modulate state queue imp
pass out on $adsl_if inet proto tcp from any to any port $bit \
        flags S/SA modulate state queue bit
pass out on $adsl_if inet proto udp from any to any port $bit keep state \
        queue bit

pass  out on $sdsl_if inet proto tcp from any to any \
        flags S/SA modulate state queue else2
pass out on $sdsl_if proto { udp, icmp } from any to any keep state
pass  out on $sdsl_if inet proto tcp from any to any port $game_ports \
        flags S/SA modulate state queue game2
pass  out on $sdsl_if inet proto tcp from any to any port $important \
        flags S/SA modulate state queue imp2
pass out on $sdsl_if inet proto tcp from any to any port $bit \
        flags S/SA modulate state queue bit
pass out on $sdsl_if inet proto udp from any to any port $bit keep state \
        queue bit

pass out on $adsl_if route-to ($sdsl_if $sdsl_gw) from $sdsl_if to any
pass out on $sdsl_if route-to ($adsl_if $adsl_gw) from $adsl_if to any

# but don't allow spoofed stuff

antispoof quick for { lo $int_if }