ext_if="fxp0"
int_if="sk0"
set skip on lo0
set loginterface $ext_if
scrub in on $ext_if all
local_net="192.168.22.0/24"

### altq
altq on $ext_if priq bandwidth 6144Kb queue { std_out, ssh_out, tcp_ack_out, dns_out }
queue std_out priq(default)
queue ssh_out priority 4 priq(red)
queue dns_out priority 5
queue tcp_ack_out priority 6

altq on $int_if cbq bandwidth 6144Kb queue { std_in, ssh_in, dns_in, ftp_in }
queue std_in bandwidth 6016Kb cbq(default,borrow)
queue ssh_in bandwidth 64Kb priority 4
queue dns_in bandwidth 32Kb priority 5
queue ftp_in bandwidth 32Kb cbq(borrow)

### rfc1918 nat
nat on $ext_if from !($ext_if) -> ($ext_if:0)
nat-anchor "ftp-proxy/*"
rdr-anchor "ftp-proxy/*"

### table for ssh hackers
table <bruteforce> persist

### ftp and squid  proxy
rdr pass on $int_if proto tcp to port ftp -> 127.0.0.1 port 8021
#rdr on $int_if inet proto tcp from any to ! $int_if port 80 -> 127.0.0.1 port 3128

### ftp-proxy
anchor "ftp-proxy/*"

### vpn
#pass in quick proto esp from $gateb to $gatea keep state
#pass out quick proto esp from $gatea to $gateb keep state
#pass in quick on enc0 proto ipencap from $gateb to $gatea keep state
#pass in quick on enc0 from $netb to $neta keep state
#pass out quick on enc0 from $neta to $netb keep state
#pass in on $ext_if proto udp from $gateb port = 500 to $gatea port = 500
#pass out on $ext_if proto udp from $gatea port = 500 to $gateb port = 500

pass in quick on $ext_if from guard to any keep state
pass in quick on tun0 from 10.8.0.0/24 to any keep state
pass in quick on tun0 from 192.168.119.0/24 to any keep state
pass in quick on tun0 from 192.168.64.0/24 to any keep state
pass out quick on tun0 from any to any keep state

### filter rules for $ext_if inbound
block in log on $ext_if all
pass in on $ext_if proto { tcp, udp } from any to $ext_if port ssh flags S/SA keep state (max-src-conn 5, max-src-conn-rate 5/3, overload <bruteforce> flush
global) queue ssh_in
block drop in log quick on $ext_if from <bruteforce>

### filter rules for $ext_if outbound
block out log on $ext_if all
pass out on $ext_if inet proto tcp from ($ext_if) to any flags S/SA keep state queue(std_out, tcp_ack_out)
pass out on $ext_if inet proto { udp icmp } from ($ext_if) to any keep state
pass out on $ext_if inet proto { tcp udp } from ($ext_if) to any port domain keep state queue dns_out
pass out on $ext_if inet proto tcp from ($ext_if) to any port 22 flags S/SA keep state queue(std_out, ssh_out)

### filter rules for $int_if inbound
block in log on $int_if all
pass in on $int_if from $local_net keep state

### filter riles for $int_if outbound
block out log on $int_if all
pass out on $int_if from any to $local_net keep state
pass out on $int_if proto { tcp udp } from any port domain to $local_net keep state queue dns_in
pass out on $int_if proto tcp from any port 22 to $local_net keep state queue(std_in, ssh_in)
pass out on $int_if proto tcp from any to any port 21 keep state queue ftp_in