ext_if = "dc0"
int_if = "dc1"

host1 = 192.168.1.2
services_firewall = { http, ftp }
services_host1 = { 18734, 55555, 1025:1050 }

table <abusive_hosts> persist
table <spammers> persist

# scrub incoming packets
scrub in

# ignore loopback interface
set skip on lo0

# translation
nat on $ext_if from $int_if:network to any -> $ext_if

rdr on $ext_if from any to $ext_if port $services_host1 -> $host1

# block abusive users
block in quick on $ext_if from { <abusive_hosts>, <spammers> }

# base block
block in on $ext_if

# allow outgoing connections
pass out quick on $ext_if proto tcp modulate state
pass out quick on $ext_if keep state

# allow icmp echo requests
pass in quick on $ext_if proto icmp from any to $ext_if icmp-type echo-request keep state

# we allow ssh seperately, so we can block abusive hosts
pass in quick on $ext_if proto tcp from any to $ext_if port ssh modulate state (source-track rule max-src-nodes 8 max--src-conn 8 max-src-conn-rate 3/60 overload <abusive_hosts> flush global)

# allow services to firewall
pass in quick on $ext_if proto tcp from any to $ext_if port $services_firewall modulate state

# allow services to host1
pass in quick on $ext_if proto tcp from any to $host1 port $services_host1 modulate state