Thanks #FreeBSD!

/etc/pf.conf:

logopt  = "log"

# Interface/network specification
ext_if  = "xl0"             # external
elan_if = "rl0"             # ethernet
wlan_if = "ath0"            # wifi
lan_ifs = "{ rl0 ath0 }"    # all internal interfaces
lan_net = "{ 10.0.0.0/23 }" # whole network (e+w)

# SSH
ssh_ext_port = "22"
ssh_srv = "10.0.0.1 port 22"

# HTTP
http_ext_port = "80"
http_srv = "127.0.0.1 port 80"





############################################################
# Everything below this point is routing commands, e.g.
# nothing that is configured by the variables above.
############################################################





# GENERAL CONFIGURATION
#   Options that are not associated with overall network
#   traffic flow.
############################################################

# Keep loopback interfaces on the local machine free of pf
# overhead.
#set skip on lo

# Keep logs of traffic on the external interface.
set loginterface $ext_if

# NAT
nat on $ext_if from ath0:network to any -> ($ext_if)
nat on $ext_if from rl0:network to any -> ($ext_if)
rdr on $ext_if proto tcp to port $ssh_ext_port -> $ssh_srv
rdr on $ext_if proto tcp to port $http_ext_port -> $http_srv

# TEMPORARY RULES XXX
# Let DNS contact the outside world
rdr on $ext_if proto tcp to port 53 -> 10.0.0.1 port 53
# XXX

# INTERNAL AND OUTBOUND TRAFFIC
#   LAN-to-LAN and LAN-to-world traffic.
############################################################

# Allows all traffic on the LAN interfaces, so traffic is
# only stopped at $ext_if.
pass quick on $lan_ifs

# Allow all traffic to reach the outside world.
pass out quick on $ext_if keep state



# OUTSIDE WORLD TRAFFIC
#   Traffic coming in from the outside world.
############################################################

# Default block policy
#block on $ext_if to $ext_if

# Allow ICMP (pinging)
pass in on $ext_if proto icmp keep state

pass in on $ext_if inet proto tcp to $ssh_srv flags S/SA synproxy state
pass in on $ext_if inet proto tcp to $http_srv flags S/SA synproxy state

pass in on $ext_if inet proto tcp to 53 flags S/SA synproxy state
# XXX temporarily open DHCP to outside world