set skip on lo0
set block-policy return
scrub in all
block in log
antispoof quick for lo0 inet
block in from no-route to any
pass out quick on lo0 all
pass in quick on lo0 all
pass out keep state
table <blacklist> persist file "/etc/blacklist"
pass inet proto icmp from any to any
pass in proto {tcp,udp} from any to any port 49152:65535 keep state
pass in on rl0 proto udp from any to (rl0) port 137 keep state
pass in on rl0 proto udp from any to (rl0) port 138 keep state
pass in on rl0 proto tcp from any to (rl0) port 22 keep state
pass in on rl0 proto tcp from any to (rl0) port 445 keep state
pass in on rl0 proto tcp from any to (rl0) port 137 keep state
pass in on rl0 proto tcp from any to (rl0) port 139 keep state
pass in on rl0 proto tcp from any to (rl0) port 6881 keep state
block on rl0 from <blacklist> to any



scrub in all fragment reassemble
block return in log all
block drop in quick on ! lo0 inet from 127.0.0.0/8 to any
block return in from no-route to any
pass out quick on lo0 all
pass in quick on lo0 all
pass out all keep state
pass inet proto icmp all
pass in proto tcp from any to any port 49152:65535 keep state
pass in proto udp from any to any port 49152:65535 keep state
pass in on rl0 proto udp from any to (rl0) port = netbios-ns keep state
pass in on rl0 proto udp from any to (rl0) port = netbios-dgm keep state
pass in on rl0 proto tcp from any to (rl0) port = ssh keep state
pass in on rl0 proto tcp from any to (rl0) port = microsoft-ds keep state
pass in on rl0 proto tcp from any to (rl0) port = netbios-ns keep state
pass in on rl0 proto tcp from any to (rl0) port = netbios-ssn keep state
pass in on rl0 proto tcp from any to (rl0) port = 6881 keep state
block return on rl0 from <blacklist> to any