pass in quick on enc0 all flags S/SA keep state fastroute
pass in quick on enc0 inet all flags S/SA keep state fastroute
pass in quick on enc0 inet6 all flags S/SA keep state fastroute
pass out quick on tun1000000 inet all flags S/SA keep state route-to tun1000001
pass out quick on tun1000000 inet from any to 192.168.1.1 flags S/SA keep state route-to tun1000001
pass out quick on tun1000000 inet6 from any to fec0::1 flags S/SA keep state route-to tun1000001
block drop in on tun1000000 inet proto tcp from any to any port = ftp dup-to 192.168.1.1@tun1000001
block drop in on tun1000000 inet6 proto tcp from any to any port = ftp dup-to fec0::1@tun1000001
pass in quick on tun1000000 inet from 192.168.1.1 to 10.1.1.1 flags S/SA keep state route-to tun1000001
pass in quick on tun1000000 inet6 from fec0::/64 to fec1::2 flags S/SA keep state route-to tun1000001
block drop in on tun1000000 inet proto tcp from any to any port = ftp reply-to 192.168.1.1@tun1000001
block drop in on tun1000000 inet6 proto tcp from any to any port = ftp reply-to fec0::1@tun1000001
pass in quick on tun1000000 inet from 192.168.1.1 to 10.1.1.1 flags S/SA keep state reply-to tun1000001
pass in quick on tun1000000 inet6 from fec0::/64 to fec1::2 flags S/SA keep state reply-to tun1000001
pass in quick on tun1000000 inet from 192.168.1.1 to 10.1.1.1 flags S/SA keep state dup-to 192.168.1.100@tun1000001
pass in quick on tun1000000 inet6 from fec0::/64 to fec1::2 flags S/SA keep state dup-to fec1::2@tun1000001