## Macros
ext_if="xl0"
int_if="sis0"
lo_if="lo0"
maincpu="172.30.20.6"

## Global options
set block-policy drop
set loginterface $ext_if

## Normalization
scrub in all

## NAT och redirect
#nat on $ext_if inet from $int_if to any -> ($ext_if)
nat on $ext_if from $int_if:network to any -> ($ext_if)
rdr on $ext_if inet proto tcp from any to $ext_if port 80 -> $maincpu port 80
rdr on $ext_if inet proto tcp from any to $ext_if port 555 -> $maincpu port 555

## Filter rules
block all
pass out keep state
pass quick on { $lo_if $int_if }
antispoof quick for { $lo_if $int_if }
pass in on $ext_if proto tcp to ($ext_if) port ssh keep state
pass in on $ext_if proto tcp to ($ext_if) port www keep state
pass out on $ext_if proto tcp all modulate state flags S/SA