### macros ###
ext_if="sk0"
int_if="ath0"
int_net="192.168.0.0/24"

### options ###
set skip on lo0

### scrub ###
scrub all no-df fragment reassemble random-id

### nat ###
nat on $ext_if from $int_net to any -> $ext_if

### filter rules ###

# block/log everything.
block log all

# allow all traffic on $int_if.
pass on $int_if

# allow ping in.
pass in quick inet proto icmp all icmp-type echoreq keep state

# allow dns in.
pass in quick on $ext_if inet proto { tcp, udp } from any to any \
        port domain modulate state flags S/SA

# allow ftp, http, ssh, smtp, pop3 in.
pass in quick on $ext_if inet proto tcp from any to any \
        port { ftp, ftp-data, http, 2022, smtp, pop3, >49151 } modulate state flags S/SA

# allow all tcp, udp and icmp pass out.
pass out quick on $ext_if inet proto { tcp, udp, icmp } all \
        modulate state flags S/SA