int_if="em0"
ext_if="dc0"
dmz_if="sk0"
tun_if="gif0"

set skip on lo
set block-policy return
#set loginterface $ext_if


altq on $ext_if bandwidth 1700Kb hfsc queue { ack, dns, ssh, web, games, mail, bulk, bittor}
 queue ack        bandwidth 30% priority 9 qlimit 500 hfsc (realtime   20%)
 queue games      bandwidth 14% priority 8 qlimit 500 hfsc (realtime 5% ecn)
 queue dns        bandwidth 5% priority 7 qlimit 500 hfsc (realtime    5%)
 queue ssh        bandwidth 20% priority 6 qlimit 500 hfsc (realtime   15%) {ssh_login, ssh_bulk}
  queue ssh_login bandwidth 50% priority 6 qlimit 500 hfsc
  queue ssh_bulk  bandwidth 50% priority 5 qlimit 500 hfsc (ecn)
 queue web        bandwidth 5% priority 5 qlimit 500 hfsc (realtime  (10%, 10000, 5%))
 queue bulk       bandwidth 20% priority 4 qlimit 500 hfsc (realtime   20% default, ecn)
 queue mail       bandwidth 5% priority 3 qlimit 500 hfsc (realtime    5%)
 queue bittor     bandwidth 1% priority 2 qlimit 500 hfsc (upperlimit 95%)

# filter rules and anchor for ftp-proxy(8)
anchor "ftp-proxy/*"
pass in quick proto tcp to port ftp rdr-to 127.0.0.1 port 8021

# anchor for relayd(8)
#anchor "relayd/*"


#match in all scrub (no-df)
match out on egress inet from !(egress) to any nat-to (egress:0)

block all
pass proto icmp
pass proto icmp6
block in quick from urpf-failed

pass out on $tun_if

pass out on $int_if to $int_if:network
pass in on $int_if from $int_if:network

pass out on $dmz_if to $dmz_if:network
pass in on $dmz_if from $dmz_if:network to !($int_if:network)

pass out on $ext_if queue (bulk, ack)

#queue specific stuff
pass out on $ext_if inet proto tcp to any port ssh modulate state queue (ssh_bulk, ssh_login)
pass out on $ext_if inet proto tcp to any port {http, https} modulate state queue (web)
pass out on $ext_if inet proto tcp to any port {smtp, smtps} modulate state queue (mail)
pass out on $ext_if inet proto udp to any port domain modulate state queue (mail)
pass out on $ext_if inet proto udp to any port 27960 modulate state queue (games)
pass out on $ext_if inet proto icmp to any queue (ack)

pass in quick on $ext_if proto udp from any to port domain


#redirects
pass in quick on $ext_if inet proto tcp from any to any port 8026 rdr-to 192.168.3.101 port ssh queue (ssh_bulk, ssh_login)
pass in quick on $ext_if inet proto tcp from any to any port ssh rdr-to 192.168.3.108 port ssh queue (ssh_bulk, ssh_login)
pass in quick on $ext_if inet proto tcp from any to any port http rdr-to 192.168.3.80 port http
pass in quick on $ext_if inet proto tcp from any to any port 9418 rdr-to 192.168.3.101 port 9418
pass in quick on $ext_if inet proto udp from any to any port 7777:7780 rdr-to 192.168.2.130 queue (games)
pass in quick on $ext_if inet proto udp from any to any port 27960 rdr-to 192.168.3.102 queue (games)
pass in quick on $ext_if inet proto tcp from any to any port 8027 rdr-to 192.168.3.103 queue (bittor)

#ipv6 passthrough
pass in quick on {$tun_if,$ext_if} inet6 proto tcp from any to 2001:470:e2de:3:5054:ff:fee9:a0bb port ssh