1*96423a97Sjsgmatch out on tun1000000 from 10.0.0.0/24 to any \ 2*96423a97Sjsg nat-to { 10.0.1.1, 10.0.1.2 } round-robin sticky-address 3*96423a97Sjsgmatch in on tun1000000 from any to 10.0.1.1 \ 4*96423a97Sjsg rdr-to { 10.0.0.0/24 } sticky-address random 5*96423a97Sjsgmatch in on tun1000000 from any to 10.0.1.2 \ 6*96423a97Sjsg rdr-to { 10.0.0.1, 10.0.0.2 } sticky-address 73bf58a56Smcbride 83bf58a56Smcbridepass in proto tcp from any to any port 22 \ 93bf58a56Smcbride keep state (source-track) 103bf58a56Smcbridepass in proto tcp from any to any port 25 \ 113bf58a56Smcbride keep state (source-track global) 123bf58a56Smcbridepass in proto tcp from any to any port 80 \ 133bf58a56Smcbride keep state (source-track rule, max-src-nodes 1000, max-src-states 3) 143bf58a56Smcbridepass in proto tcp from any to any port 123 \ 156e22c39fSmcbride keep state (source-track, max-src-nodes 1000) 163bf58a56Smcbridepass in proto tcp from any to any port 321 \ 173bf58a56Smcbride keep state (source-track, max-src-states 3) 18