int_if="rl0"
ext_if="vr0"
ext_ip="192.168.10.2"
int_ip="10.129.13.251"
comps="{10.129.13.241, 10.129.13.234, 10.129.13.211, 10.129.13.252, 10.129.13.218}"
#comps="10.129.13.0/24"
internal="10.0.0.0/8"
web_ports="{80, 443}"
good_ports="{80, 443, 110, 25, 993, 465, 2041, 2042, 6667}"
messaging_ports="{2041, 2042, 6667}"
mail_ports="{110, 25, 993, 465}"
set skip on lo

scrub in all

altq on $ext_if priq bandwidth 220Kb queue { dns_out, tcp_ack_out,\
                                             std_out, messaging_out, mail_out}

queue std_out           priq(default)
queue mail_out          priority 2 priq(red)
queue messaging_out     priority 4 priq(red)
queue dns_out           priority 5
queue tcp_ack_out       priority 6

altq on $int_if cbq bandwidth 220Kb queue { std_in, messaging_in, dns_in, \
                                            mail_in}

queue std_in            bandwidth 140Kb cbq(default)
queue messaging_in      bandwidth 20Kb cbq priority 4
queue dns_in            bandwidth 10Kb cbq priority 5
queue mail_in           bandwidth 50Kb cbq(borrow)

nat-anchor "ftp-proxy/*"
rdr-anchor "ftp-proxy/*"
rdr pass on $int_if proto tcp from $comps to any port 21 -> 127.0.0.1 port 8021
rdr on $int_if inet proto tcp from $comps to any port 80 -> 127.0.0.1 port 3128
nat on $ext_if from $comps to any -> $ext_ip

anchor "ftp-proxy/*"

# Strange behavior
block in on $int_if from 10.129.13.210
block in on $int_if from 10.129.13.237

# I am not router for internal network except myself
block in on $int_if from $internal to $internal
block in on $int_if to 10.129.13.255

# Allow good ports
pass in on $int_if proto tcp from $comps to any port $good_ports

# All to me are allowed
pass in on $int_if proto tcp from $comps to $int_ip
pass in on $int_if proto udp from $comps to $int_ip
pass out on $int_if proto tcp from $int_ip to $comps
pass out on $int_if proto udp from $int_ip to $comps

# Allow pings
pass in on $int_if proto icmp from $comps to any

# Output rules
block out on $ext_if all
pass out on $ext_if inet proto tcp from ($ext_if) queue (std_out, tcp_ack_out)
pass out on $ext_if inet proto {udp, icmp} from ($ext_if)
pass out on $ext_if inet proto {tcp, udp} from ($ext_if) to port domain queue dns_out
pass out on $ext_if inet proto tcp from ($ext_if) to port $messaging_ports queue (std_out, messaging_out)
pass out on $ext_if inet proto tcp from ($ext_if) to port $mail_ports queue mail_out
pass out on $ext_if inet proto tcp from ($ext_if) to port $web_ports queue (std_out)

# Input rules
block out on $int_if all
pass out on $int_if to $comps
pass out on $int_if proto {tcp, udp} from port domain to $comps queue dns_in
pass out on $int_if proto tcp from port $messaging_ports to $comps queue messaging_in
pass out on $int_if proto tcp from port $mail_ports queue mail_in
pass out on $int_if proto tcp from port $web_ports to $comps queue std_in