set skip on lo0
set block-policy return
set loginterface rl0
scrub in all
block in log
antispoof quick for lo0 inet
block in from no-route to any
pass out keep state
table <blacklist> persist file "/etc/blacklist"
pass inet proto icmp from any to any
pass in proto {tcp,udp} from any to any port 49152:65535 keep state
pass in quick on rl0 proto udp from any to (rl0) port 137 keep state
pass in quick on rl0 proto udp from any to (rl0) port 138 keep state
pass in quick on rl0 proto tcp from any to (rl0) port 22 keep state
pass in quick on rl0 proto tcp from any to (rl0) port 445 keep state
pass in quick on rl0 proto tcp from any to (rl0) port 137 keep state
pass in quick on rl0 proto tcp from any to (rl0) port 139 keep state
block on rl0 from <blacklist> to any