#interfaces
int_if="sis0"
ext_if="rl0"

#Local network
int_net="{1.1.1.1/8}"

#external network
ext_net="{0.0.0.0/29}"

#internal server's IP
int_ip="{10.1.1.1}"

#external server's IP
ext_ip="{209.155.0.66}"

#macroses
level0="{}"
level1="{}"
level2="{}"

tcp_in="{21,30,25,80,110,139,5190, 995, 465}"
udp_in="{53,137,138}"

tcp_out="{30,25,53,80,110,5190,995,465}"
udp_out="{53}"

all_hosts = "{"$level0 $level1 $level2"}"

#tables
table <top> persist {$level0 }
table <middle> persist {$level1 }
table <bottom> persist {$level2 }
table <spammers> persist file "/etc/spammers"

#protect from scrubbing, do not filter on loopback
scrub in all
set skip on lo0
set skip on $int_if
antispoof for $ext_if inet

#distribute the traffic
#Root Queue (2Mbps)
#       UserA (1Mbps)
#           ssh (100Kbps)
#           ftp (900Kbps, borrow)
#       UserB (1Mbps)

altq on $ext_if cbq bandwidth 1.5Mb queue {lvl0, lvl1, lvl2 }
    queue lvl0 bandwidth 50% cbq(default)
    queue lvl1 bandwidth 25% cbq(ecn)
    queue lvl2 bandwidth 25% cbq(ecn)

#NAT
nat on $ext_if from $all_hosts to any -> ($ext_if)

#passing

##blocking all traffic
block all

##rules of passing

###pass into ext
pass in on $ext_if from <top> to $ext_ip port {$tcp_out,$udp_out} keep state queue lvl0
pass in on $ext_if from <middle> to $ext_ip port {$tcp_out,$udp_out} keep state queue lvl1
pass in on $ext_if from <bottom> to $ext_ip port {$tcp_out,$udp_out} keep state queue lvl2

###pass outof ext
pass out on $ext_if from <top> to $ext_ip port {$tcp_out,$udp_out} keep state queue lvl0
pass out on $ext_if from <middle> to $ext_ip port {$tcp_out,$udp_out} keep state queue lvl1
pass out on $ext_if from <bottom> to $ext_ip port {$tcp_out,$udp_out} keep state queue lvl2