#################################################################
# macro definitions

ext_if  = "dc0"
ext_if2 = "dc1"

ext_gw  = "proper.gateway"
ext_gw2 = "same.gateway-also.correct"

int_if  = "re0"
dmz1_if = "re0"

tcp_services    =       "{ 22, 113 }"
icmp_types      =       "echoreq"

web_server      =       "10.8.8.8"

#################################################################
# options: "set"

set block-policy return
set loginterface $ext_if
set skip on lo

#################################################################
# scrub rules: "scrub"
scrub in

#################################################################
# NAT rules: "rdr", "nat", "binat"


nat on $ext_if from 10.8.8.0/24 to any -> ($ext_if)
nat on $ext_if2 from 10.8.8.0/24 to any -> ($ext_if2)

nat-anchor "ftp-proxy/*"


# Catch stuff and send it to ftp-proxy
rdr-anchor "ftp-proxy/*"
rdr on $int_if proto tcp from any to any port { 21, 2121, 2100, 8888, 1999}  -> 127.0.0.1 port 8021


# Redirect web traffic to web_server
rdr on $ext_if proto tcp from any to any port 80 -> $web_server



#################################################################
# filtering rules: "antispoof", "block", "pass"


block in

anchor "ftp-proxy/*"

# Spoofed Address Protection
antispoof quick for { lo $int_if }

pass out on $int_if from any to 10.8.8.0/24

pass in on $ext_if inet proto tcp from any to ($ext_if) port $tcp_services flags S/SA keep state

pass in quick on $int_if from 10.8.8.0/24 to $int_if


# Pass Traffic to web_server
pass in on $ext_if inet proto tcp from any to $web_server port 80 flags S/SA synproxy state


pass in inet proto icmp all icmp-type $icmp_types keep state


# Quickly pass all internal traffic (assumed good)
#pass in quick on $int_if

pass in on $int_if route-to { ($ext_if $ext_gw), ($ext_if2 $ext_gw2) } round-robin proto tcp from 10.8.8.0/24 to any flags S/SA modulate state

pass in on $int_if route-to { ($ext_if $ext_gw), ($ext_if2 $ext_gw2) } round-robin proto { udp, icmp } from 10.8.8.0/24 to any keep state


#  general "pass out" rules for external interfaces
pass out on $ext_if proto tcp from any to any flags S/SA modulate state
pass out on $ext_if proto { udp, icmp } from any to any keep state
pass out on $ext_if2 proto tcp from any to any flags S/SA modulate state
pass out on $ext_if2 proto { udp, icmp } from any to any keep state


pass out on $ext_if route-to ($ext_if2 $ext_gw2) from $ext_if2 to any
pass out on $ext_if2 route-to ($ext_if $ext_gw) from $ext_if to any