block in from any to any
block out from any to any
# pass all outgoing packets on internal interface
# pass in quick any packets destined for the gateway itself

pass in on $int_if from $lan_net to any port $important
pass in on $int_if from $lan_net to any port $game_ports
pass in quick on $int_if from $lan_net to $int_if

# packet filtering
pass in on $int_if route-to \
   { ($adsl_if $adsl_gw), ($sdsl_if $sdsl_gw) } round-robin sticky-address\
   proto tcp from $lan_net to any port $important \
	 flags S/SA modulate state

pass in on $int_if route-to \
   { ($adsl_if $adsl_gw), ($sdsl_if $sdsl_gw) } round-robin sticky-address\
   proto tcp from $lan_net to any port $game_ports \
	 flags S/SA modulate state

pass in on $int_if route-to \
{ ($adsl_if $adsl_gw), ($sdsl_if $sdsl_gw) } round-robin sticky-address\
   proto {udp, icmp} from $lan_net to any port \
	keep state

block out on $int_if all

pass out on $int_if proto {udp,tcp,icmp} from any port to $lan_net \
	
pass out on $adsl_if route-to ($sdsl_if $sdsl_gw) from $sdsl_if to any
pass out on $sdsl_if route-to ($adsl_if $adsl_gw) from $adsl_if to any

# but don't allow spoofed stuff
block quick on $int_if proto tcp from 192.168.1.204 to any
antispoof quick for {$int_if }