ext_if = "tun0"
int_if = "sis1"
lan_net  = "192.168.38.0/24"

set skip on lo0
set block-policy drop
set limit { states 8192, frags 4096}
set optimization conservative

scrub in all
scrub out all
scrub reassemble tcp

nat on $ext_if from $lan_net to any -> ($ext_if)
nat-anchor "ftp-proxy/*"
rdr-anchor "ftp-proxy/*"
rdr pass on $int_if proto tcp to port ftp -> 127.0.0.1 port 8021

## default deny
block in

# activate spoofing protection for the internal interface and loopback.
antispoof quick for { lo $int_if }

pass out keep state

anchor "ftp-proxy/*"

pass quick on $int_if keep state