#==================== DEFS ====================
ext = "bfe0"

table <priv_nets> const { 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, \
	10.0.0.0/8, !10.0.0.0/24 } 

tcp_services = "{ ssh, ftp, ftp-data, 17778, 4662, 49152:65535 }"
icmp_types = "echoreq"

#==================== OPTIONS ====================
set block-policy return
set loginterface $ext
set optimization conservative

#==================== SCRUB ====================
scrub in all

#==================== QUEUE ====================
altq on $ext priq bandwidth 350Kb queue {q}
queue q priority 1 priq(default)

#==================== FILTERING ====================
block all

# loopback
pass quick on lo0 all
antispoof for lo0

# ESP
pass quick proto esp

# block private networks
block drop in  quick on $ext from <priv_nets> to any
block drop out quick on $ext from any to <priv_nets>

# incoming
pass in on $ext proto tcp from any to ($ext) port $tcp_services \
	modulate state
pass in inet proto icmp icmp-type $icmp_types keep state

# outgong
pass out on $ext proto tcp modulate state
pass out on $ext proto { udp, icmp } keep state 

