The OpenBSD Packet Filter(PF) 是一个很有创意的防火墙，差不多你想得到的功能它都可以实行，并且他是一个statefull 的防火墙（相反iptables是个StateLess防火墙）在Statefull的规则下性能表现良好。
学校的防火墙经历PIX(Cisco)-->Iptables(Linux)-->IPF+IPNAT(FreeBSD)-->PF(FreeBSD)-->PF(OpenBSD)，在使用PF之前，IPF和Iptables的Ftp-proxy都是基于内核的，而PF的Ftp-proxy却把它放在用户进程中，并且使用Inetd做为他的Lisntening。
由于Ftp-proxy使用用户进程，所以配置起来比其他防火墙麻烦一些，官方的配置为
pf.conf:
rdr on $int_if proto tcp from $lannet to any port 21 -> 127.0.0.1 \
port 8021
inetd.conf:
127.0.0.1:8021 stream tcp nowait root /usr/libexec/ftp-proxy ftp-proxy
根据MailList和其他资料，发现他们都不得要领，说要改inetd.conf
ftp-proxy stream tcp nowait root /usr/libexec/ftp-proxy ftp-proxy -u proxy -n -m 20000 -M 22000 -t 180或者该service增加ftp-proxy 8021，其实他们说的都不得要领，但我把pf.conf的PF规则改成
rdr pass on $int_if proto tcp from $lannet to any port 21 -> 127.0.0.1 \
port 8021
发现一切都正常了，原来就这么简单.
官方文档如此说明pass的作用:
The only exception to this rule is when the pass keyword is used within the rdr rule. In this case, the redirected packets will pass statefully right through the filtering engine: the filter rules won't be evaluated against these packets. This is a handy shortcut to avoid adding pass filter rules for each redirection rule. Think of it as a normal rdr rule (with no pass keyword) associated to a pass filter rule with the keep state keyword. However, if you want to enable more specific filtering options such as synproxy, modulate state, etc. you'll still have to use a dedicate pass rule as these options don't fit into redirection rules