ext_if = fxp0
host_ip = 10.50.3.5
jail_ip = 10.50.3.69
mail_ip = 10.50.3.70
table <rfc1918> const { 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8 }
table <my_net> const { 10.50.3.0/24 }

block in log on $ext_if

pass in on $ext_if inet proto tcp from any to any port 22
pass in on $ext_if inet proto tcp from any to $jail_ip port 113
pass in on $ext_if inet proto udp from any to $host_ip port 53
pass in on $ext_if inet proto tcp from any to $host_ip port 80
pass in on $ext_if inet proto tcp from any to $host_ip port 137:139
pass in on $ext_if inet proto tcp from any to $host_ip port 68
pass in on $ext_if inet proto tcp from any to $mail_ip port { 25,993 }
block out log from $jail_ip to <rfc1918>
pass out on $ext_if proto tcp from $jail_ip port 22 to any
pass proto udp from $jail_ip to $host_ip port 53
pass out on $ext_if from $host_ip to any keep state
pass out on $ext_if from $jail_ip to !<rfc1918> keep state
pass out on $ext_if from $mail_ip to any keep state