ext="xl0"
int="rl0"

tcp_services="{ 22, 113, 80 }"
icmp_types="echoreq"

comp1="192.113.113.10"
comp2="192.113.113.11"
comp3="192.113.113.12"
comp4="192.113.113.13"

set block-policy return
set loginterface $ext
set skip on lo
scrub in

nat on $ext from $int to any -> ($ext)
rdr on $ext proto tcp from any to any port 80 -> $comp2

block in
pass out keep state
antispoof quick for { lo $int }

pass in on $ext inet proto tcp from any to ($ext) port $tcp_services flags S/SA keep state

pass in on $ext inet proto tcp from any to $comp2 port 80 \
	flags S/SA synproxy state

pass in inet proto icmp all icmp-type $icmp_types keep state

pass in quick on $int