fxp1 = 192.168.10.1

####################
#### Variables #####
####################

External="fxp0"
Internal="fxp1"
Loop="lo0"
NoRoute= "{ 0.0.0.0/8, 10.0.0.0/8, 127.0.0.0/8, 20.20.20.0/24, 169.254.0.0/16,
        172.16.0.0/12, 192.0.2.0/24, 192.168.0.0/16, 224.0.0.0/3,
        255.255.255.255 }"


icmp_types = "{ 0, 3, 4, 8, 11, 12 }"

####################################
#### Options and Optimizations #####
####################################

set loginterface $External
set optimization aggressive
set limit { frags 2500, states 5000 }
set block-policy return

#######################
#### Normalization ####
#######################

scrub in on $External all no-df

#############
#### NAT ####
#############

nat on $External inet from 192.168.10.0/24 to any -> ($External)
nat-anchor "pftpx/*"
rdr-anchor "pftpx/*"
rdr on $Internal inet proto tcp from any to any port 21 -> 127.0.0.1 port 8021

######################
#### Portforwards ####
######################

rdr on $External inet proto tcp from any to any port 20001 -> 192.168.10.10 port 20001

anchor "pftpx/*"

##############################
#### Loopback Interfance #####
##############################

pass in quick on $Loop all keep state
pass out quick on $Loop all keep state

#############################
#### Internal interface #####
#############################

pass in quick on $Internal all keep state
pass out quick on $Internal all keep state

##################################
#### External interface (In) #####
##################################

block in quick on $External from $NoRoute to any
pass in on $External proto tcp from any to $External port 20001 keep state
pass in on $External inet proto udp from any to $External port 67 keep state
pass in on $External inet proto udp from any to $External port 68 keep state
pass in on $External inet proto tcp from any to $External port > 1024 user proxy keep state
pass in on $External inet proto icmp all icmp-type $icmp_types keep state
block in on $External all

##################################
#### External interface (Out) ####
##################################

block out on $External from any to $NoRoute
pass out quick on $External inet proto udp from any to any port 53 keep state 
pass out quick on $External inet proto tcp from any to any port 80 flags S/SA keep state 
pass out quick on $External inet proto tcp from any to any port 21 keep state
pass out quick on $External inet proto tcp from any to any user proxy flags S/SA keep state 
pass out quick on $External inet proto tcp from any to any port 443 keep state 
pass out quick on $External inet proto tcp from any to any port 25 keep state 
pass out quick on $External inet proto tcp from any to any port 110 keep state 
pass out quick on $External proto udp from $External to any port 67 keep state 
pass out quick on $External proto udp from $External to any port 68 keep state 
pass out quick on $External inet proto icmp all icmp-type $icmp_types keep state queue q_prio
block out on $External all