# I need pass only traffic between this offices on 80, 1494, 3389 ports
#

# vpn interface to another office with 192.168.130.4 IP address
vpn_if="rl0"
#  internal interface
int_if="rl1"
# tunnel interface (OpenVPN)
ext_if="tun0"

set skip on { lo $int_if $ext_if $tun_if }

scrub in

antispoof quick for { lo $int_if}
block log all

pass out on $vpn_if inet proto tcp from ($ext_if:0) to 192.168.130.4 port 5000 keep state label "VPN connection"

# passing ping's
pass inet proto icmp all keep state

pass in on $ext_if inet proto tcp from any to ($ext_if) port ssh keep state label "Incoming SSH from another office"
pass in on $int_if inet proto tcp from any to ($int_if) port ssh keep state label "Incoming SSH from Internal"

# Passing out to another office
pass out on $ext_if inet proto tcp from ($int_if:network) to {192.168.1.0/24, 192.168.197.0/24} port {80, 1494, 3389} keep state
pass in on $int_if inet proto tcp from ($int_if:network) to {192.168.1.0/24, 192.168.197.0/24} port {80, 1494, 3389} keep state

# Passing in from another office
pass in on $ext_if inet proto tcp from {192.168.1.0/24, 192.168.197.0/24} to ($int_if:network) port {80, 1494, 3389} keep state
pass out on $int_if inet proto tcp from ($int_if:network) to {192.168.1.0/24, 192.168.197.0/24} port {80, 1494, 3389} keep state