add 100 allow all from any to any via lo0			// allow loopback out
add 200 deny all from any to any frag				// deny fragmented packets

add 1000 divert natd all from any to any in via rl0             // allow outbound lan traffic

add 4900 deny icmp from any to any in via rl1 icmptypes 8	// deny incoming ping requests
add 5000 check-state						// dynamic rule
add 5100 allow all from any to any out via rl1 keep-state	// allow all established traffic


add 65000 deny all from any to any				// default to deny cleanup rule