ext_if="xl0"
tcp_services="{ 80, 443, 9001, 9030, 9031, 9090, 9091, 6665:6669, 5050 }"
icmp_types="{ echoreq }"
table <bad-guys> persist
table <good-guys> persist
set block-policy drop
set loginterface $ext_if
set limit frags 2500
set limit src-nodes 5000
set limit states 5000
set optimization aggressive
set skip on lo0
scrub in all fragment reassemble min-ttl 15 max-mss 1400 no-df
block in log on $ext_if all
block in log quick on $ext_if from <bad-guys> to $ext_if
pass in log quick on $ext_if from <good-guys> to $ext_if keep state
block out log on $ext_if all
block out log quick on $ext_if from $ext_if to <bad_guys>
pass out log quick on $ext_if from $ext_if to <good_guys> keep state
pass out quick on $ext_if proto tcp from $ext_if to any port $tcp_services flags S/SA modulate state
pass out quick inet proto icmp from $ext_if to any icmp-type $icmp_types keep state