# allow vpn (ipsec) from central to sicredi.
pass in proto esp from $sicredi_ext_ip to $central_ipsec
pass out proto esp from $central_ipsec to $sicredi_ext_ip

pass in on enc0 proto ipencap from $sicredi_ext_ip to $central_ipsec
pass in quick on enc0 from $sicredi_net to $central_int_net
pass out quick on enc0 from $central_int_net to $sicredi_net

pass in on $central_ext proto udp from $sicredi_ext_ip port = 500 to \
        $central_ipsec port = 500
pass out on $central_ext proto udp from $central_ipsec port = 500 to \
        $sicredi_ext_ip port = 500

# allow all traffic on $central_int.
pass on $central_int

# allow orkut to <ti>.
pass in quick on $central_int inet proto tcp from <ti> to <orkut> \   
        port { http, https } modulate state flags S/SA

# block orkut.
block drop in quick on $central_int inet proto tcp from any to <orkut> \
        port { http, https }

# allow msn to <ti>.
pass in quick on $central_int inet proto tcp from <ti> to any \
        port 1863 modulate state flags S/SA

# block msn.
block in quick on $central_int inet proto tcp from any to any port 1863

# allow ping.
pass in quick inet proto icmp all icmp-type echoreq keep state

# allow vpn (pptp)
pass quick on tun   
pass in quick on $central_ext inet proto tcp from any to $central_ext_ip \
        port pptp modulate state flags S/SA
pass in quick on $central_ext inet proto gre from any to $central_ext_ip \
        keep state

# allow dns.
pass in quick on $central_ext inet proto udp from any to $central_ext_ip \
        port domain keep state

# allow ftp and http to odin.
pass in quick on $central_ext inet proto tcp from any to $odin_int \
        port { ftp, ftp-data, http, > 49151 } modulate state flags S/SA

# allow saint gobain XFB to come in.
pass in quick on $central_ext inet proto tcp from $saint_ext to $cam_int \
        port 6330 modulate state flags S/SA

# allow all tcp, udp and icmp pass out.
pass out quick on $central_ext inet proto { tcp, udp, icmp } all \
        modulate state flags S/SA