####normal begin
block in log on {$ext,$int} all
block out log on  {$ext,$int} all

#block spoofers
block in log quick on $ext from <reserved>

pass out log  on $int to $lan_clients
##<done>

##allow acces to tcp services

pass out log on $ext inet proto tcp from {($ext),$lan_clients} \
              $tcpflags keep state queue (std_out,tcp_ack_out)
pass in log quick on $ext inet proto tcp to ($ext) \
              port {4662,6667} $tcpflags keep state
pass in log quick on $ext inet proto tcp to $lan_clients port \
                 {4662,6667} $tcpflags keep state


###forward some tcp
block in log quick on $ext inet to ! ($ext)

pass out log quick on $int inet proto tcp from ($int) to $lan_clients \
                     $tcpflags keep state

###allow lan_clients to go  outside

pass in log quick on $int inet proto tcp from $lan_clients to ! ($int) \
                     $tcpflags keep state

### end of tcp rules