ext_if="xl0"
int_if="sis0"

scrub in all

nat on $ext_if from !($ext_if) -> ($ext_if:0)

block in
pass out keep state

#pass quick on { lo $int_if }
antispoof quick for { lo $int_if }

pass in on $ext_if proto tcp to ($ext_if) port ssh keep state