lan_net="192.168.1.0/24"
adsl_if="tl0"
adsl_gw="64.81.53.1"
int_if="vr0"
sdsl_if="tl1"
sdsl_gw="66.92.12.1"

set block-policy drop
set limit states 50000
set loginterface $int_if
scrub all reassemble tcp

#Queue galore

# nat on both interfaces from internal
nat on $adsl_if from $lan_net to any -> ($adsl_if) 
nat on $sdsl_if from $lan_net to any -> ($sdsl_if)

#port forwarding section

rdr pass on $sdsl_if proto {tcp,udp} from any to $sdsl_if port 2056 -> $Me
rdr pass on $adsl_if proto {tcp,udp} from any to $adsl_if port 2056 -> $Me

rdr pass on $adsl_if proto {tcp,udp} from any to $adsl_if port 6112 -> \
$Harvey
rdr pass on $sdsl_if proto {tcp,udp} from any to $sdsl_if port 6112 -> \
$Harvey

#End of port forwarding

block in from any to any
block out from any to any
# pass all outgoing packets on internal interface
# pass in quick any packets destined for the gateway itself

pass in on $int_if from $lan_net to any port $important
pass in on $int_if from $lan_net to any port $game_ports
pass in quick on $int_if from $lan_net to $int_if

# packet filtering
pass in on $int_if route-to \
   { ($adsl_if $adsl_gw), ($sdsl_if $sdsl_gw) } round-robin sticky-address\
   proto tcp from $lan_net to any port $important \
	 flags S/SA modulate state

pass in on $int_if route-to \
   { ($adsl_if $adsl_gw), ($sdsl_if $sdsl_gw) } round-robin sticky-address\
   proto tcp from $lan_net to any port $game_ports \
	 flags S/SA modulate state

pass in on $int_if route-to \
{ ($adsl_if $adsl_gw), ($sdsl_if $sdsl_gw) } round-robin sticky-address\
   proto {udp, icmp} from $lan_net to any port \
	keep state

block out on $int_if all

pass out on $int_if proto {udp,tcp,icmp} from any port to $lan_net \
	
pass out on $adsl_if route-to ($sdsl_if $sdsl_gw) from $sdsl_if to any
pass out on $sdsl_if route-to ($adsl_if $adsl_gw) from $adsl_if to any

# but don't allow spoofed stuff
block quick on $int_if proto tcp from 192.168.1.204 to any
antispoof quick for {$int_if }