# Variáveis

external_if="rl0"
internal_if="rl1"

external_addr="200.1.1.3"
internal_addr="192.168.1.1"
carp_addr="200.1.1.1"
web_servers_cidr="192.168.1.10/30"

source_hash="0x61231678"

# Normaliza pacotes
match all in scrub (no-df)
...
...
# RDR
match-in on $external_if proto tcp from any to $external_addr port { http , https } rdr-to $web_servers_cidr source-hash $source_hash
...
...
# INTERFACE INTERNA
pass out quick on $internal_if proto tcp from any to $web_servers_cidr port { http , https }
...
...
# Bloqueia todo o resto
block log all