# macros
my_if = "rl0"
vpn_if = "tun0"
vpn_network = "192.168.1.0/24"
my_network = "192.168.0.0/24"

# Tables
table <abusive> persist

# aliases to be used
tcp_services = "{ 22, 21, 25, 53, 80, 993, 943, 8080, 25000, 1194 }"
udp_services = "{ 53, 1194, 25000 }"
icmp_types = "echoreq"

# blocked private nets I don't use...
priv_nets = "{ 127.0.0.0/8, 172.16.0.0/12, 10.0.0.0/8 }"

# options
set block-policy return
set loginterface $my_if

# scrub
scrub in all

# nat stuff
nat on $my_if from $vpn_network to any -> ($my_if)
nat on $my_if from $my_network to $vpn_network -> ($vpn_if)

# filter rules
#block log all

block in quick from <abusive>

antispoof for $my_if inet

pass quick on lo0 all

pass in on $my_if proto tcp from any to ($my_if) \
  port $tcp_services flags S/SA keep state \
  (max-src-conn-rate 10/10, overload <abusive> flush global)

pass in on $my_if inet proto udp from any to any \
   port $udp_services keep state

pass out on $my_if proto tcp all modulate state flags S/SA
pass out on $my_if proto { udp, icmp } all keep state

block drop in log on $my_if from $priv_nets to any
block drop out log on $my_if from any to $priv_nets

pass in on $my_if proto udp from any to port 25000 keep state
pass in on $vpn_if

pass in on $my_if from 192.168.0.0/24 to any
pass out on $my_if from any to any