set timeout { interval 10, frag 30 }
set timeout { tcp.first 120, tcp.opening 30, tcp.established 86400 }
set timeout { tcp.closing 900, tcp.finwait 45, tcp.closed 90 }
set timeout { udp.first 60, udp.single 30, udp.multiple 60 }
set timeout { icmp.first 20, icmp.error 10 }
set timeout { other.first 60, other.single 30, other.multiple 60 }
set timeout { adaptive.start 0, adaptive.end 0 }
set limit { states 20000, frags 10000 }

set optimization aggressive
set block-policy return
set state-policy if-bound
set loginterface $ext_if
set skip on lo0
scrub in all

block  in all
block out all
pass quick on lo0 all

pass in inet proto icmp all icmp-type $icmp_types keep state
pass out on $ext_if proto tcp all modulate state flags S/SA
pass out on $ext_if proto { udp, icmp } all keep state
pass in log on $ext_if proto tcp from any to $deea port $web flags S/SA keep state
pass in log on $ext_if proto tcp from any to $deea port $ftp flags S/SA keep state
pass in log on $ext_if proto tcp from any to $deea port 49999 >< 50201 flags S/SA keep state
#