Why OpenBSD? PF tools: Proxies, l7 inspection

Two proxies in base: ftp-proxy and tftp-proxy

Enable cross-firewall traffic for those protocols with divert-to:

pass in on egress proto tcp to port ftp divert-to $proxy port ftp-proxy

pass out proto tcp from $proxy to port ftp

See eg http://home.nuug.no/~peter/pf/newest/ftpnewproxy.html

Others (squid, snort) from packages hook in via divert-to too