PF loopback RDR solves the problem that intranet users are not allowed to access the Intranet when Nat is used to publish an Intranet web site.

Int_if = "rl0"
Cnc_if = "rl2"

Internal_net = "192.168.0.0/16"

Cnc_addr = "21.10.4.6"
Web_server = "192.168.200.144"
Routerip = "192.168.200.101"
Intnet = "192.168.0.0/16"

No nat on $ int_if from $ int_if to $ internal_net
Nat on $ int_if proto TCP from $ internal_net to $ web_server port www-> ($ int_if)
Nat on $ cnc_if from $ internal_net to any-> ($ cnc_if)

RDR on $ int_if proto TCP from $ internal_net to $ cnc_addr port www-> $ web_server port WWW
RDR pass on $ cnc_if proto TCP from any to $ cnc_addr port {20, 21, 80}-> $ web_server