# Block those DDOS
#set limit { states 20000, frags 20000 }

# Optimize those packets!
set optimization aggressive

set block-policy return

ext_if="em0"
int_if="em1"

$int_if="81.216.72.0/24, 81.216.76.0/24"

#macro
TCP_OPTIONS = "flags S/SAFRUP keep state"
Games_tcp = "{ 6112:6119,3724,6667,28910,29900,29920,4711,16567 }"
Games_udp = "{ 29900,29901,29902,29903,29904,16567,55125,55123,55124 }"

# Only let ping in and out
#pass out on $ext_if inet proto icmp all icmp-type 8 code 0 keep state
#pass in on $ext_if inet proto icmp all icmp-type 8 code 0 keep state

# block all in
block in on $ext_if all

# silently drop broadcasts
block in quick on $ext_if from any to 255.255.255.255

# screw with nmap
block in log quick proto tcp flags FUP/WEUAPRSF
block in log quick proto tcp flags WEUAPRSF/WEUAPRSF
block in log quick proto tcp flags SRAFU/WEUAPRSF
block in log quick proto tcp flags /WEUAPRSF
block in log quick proto tcp flags SR/SR
block in log quick proto tcp flags SF/SF


# Games tcp
pass in quick on $ext_if inet proto tcp from any to ($ext_if) port $Games_tcp $TCP_OPTIONS

# Games udp
pass in quick on $ext_if inet proto udp from any to ($ext_if) port $Games_udp keep state

# outgoing UDP
pass out quick on $ext_if proto udp all keep state

# pass out all TCP connections
pass out quick on $ext_if proto tcp all keep state