# Interfaces
wan="rl0"
lan="fxp0"
#wifi="fxp1"

# Hosts
thermopylae="172.31.1.1"
r1="172.31.1.2"
r2="172.31.1.3"
juniper="172.31.1.4"

eclipse="172.31.1.101"
aspie="172.31.1.102"

wrt="192.168.200.1"

# Protocols
ftp_ports="{ 21, 989, 990 }"
tcp_ports="{ 113, 873 }"
udp_ports="{ 873 }"

set block-policy return
set loginterface $wan

set skip on lo

scrub in log (all) all

nat on $wan from !($wan) to any -> ($wan)
nat-anchor "ftp-proxy/*"

rdr-anchor "ftp-proxy/*"
rdr on $lan proto tcp from any to any port $ftp_ports -> 127.0.0.1 port 8021

block in log (all) on $wan all
#block in log (all) on $wifi all

pass out log (all) all keep state

anchor "ftp-proxy/*"

#antispoof quick for { lo, $lan, $wifi }

pass in log (all) inet proto tcp from any to any port ssh keep state queue(ssh_bulk, ssh_interactive)
pass in log (all) inet proto tcp from any to any port $tcp_ports keep state
pass in log (all) inet proto udp from any to any port $udp_ports keep state
pass in log (all) inet proto icmp all icmp-type echoreq keep state
pass in log (all) quick on $lan