ext_if="vge0"   # replace with actual external interface name i.e., dc0
int_if="nat0"   # replace with actual internal interface name i.e., dc1
internal_net="10.3.0.0/8"
external_addr="88.191.22.60"
scrub in all
nat on $ext_if from $internal_net to any -> ($ext_if)

pass in all
pass out all

##Block Default
block in log all
##SSH
pass  in  on $ext_if proto tcp from any to $ext_if port 22 keep state
##PING
pass  in  on $ext_if proto icmp from any to any
pass  out on $ext_if proto icmp from any to any
##OutGoing
pass  out on $ext_if proto { tcp, udp } all keep state