1match out on tun1000000 inet from 10.0.0.0/24 to any nat-to { 10.0.1.1, 10.0.1.2 } round-robin sticky-address 2match in on tun1000000 inet from any to 10.0.1.1 rdr-to 10.0.0.0/24 random sticky-address 3match in on tun1000000 inet from any to 10.0.1.2 rdr-to { 10.0.0.1, 10.0.0.2 } round-robin sticky-address 4pass in proto tcp from any to any port = ssh flags S/SA keep state (source-track global) 5pass in proto tcp from any to any port = smtp flags S/SA keep state (source-track global) 6pass in proto tcp from any to any port = http flags S/SA keep state (source-track rule, max-src-states 3, max-src-nodes 1000) 7pass in proto tcp from any to any port = ntp flags S/SA keep state (source-track rule, max-src-nodes 1000) 8pass in proto tcp from any to any port = pip flags S/SA keep state (source-track global, max-src-states 3) 9