# the external network interface
ext_if="fxp0"
# the internal network interface, connected with the 2nd server
int_if="fxp1"
#internal_net="10.0.0.1/2"
#external_addr="xx.xx.xx.xx"

# tables
table <bruteforce> persist

# block offending tables
block quick from <bruteforce>

# activate scrub, apperantly its usefull
scrub in all

# detect ssh brute force
pass in on $ext_if proto tcp from any to $ext_if port ssh flags S/SA keep state (max-src-conn-rate 3/30, overload <bruteforce> flush global)

# allow all outbound connections
pass out on $ext_if proto { tcp, udp, icmp } all keep state

# allow all from the internal network
pass in on $int_if all