set block-policy drop
set limit states 900000000
set optimization normal
scrub in all
antispoof for sk0 inet
antispoof for sk1 inet
set skip on lo0
block in all
block out all
block drop in quick on sk0 from any os { SCO, NMAP }
block drop in quick on sk1 from any os { SCO, NMAP }
pass in quick proto tcp from any to any port {443,21,22,25,110,465,587,993,995,996,2082,2086,2087,2095,2096,81,43,2089,3389,4643,113,57214,37240,1313,28748,1863,902} flags S/SA keep state
pass out quick proto tcp from any to any port {443,21,22,25,110,465,587,993,995,996,2082,2086,2087,2095,2096,81,43,2089,3389,4643,113,57214,37240,1313,28748,1863,902} flags S/SA keep state
pass in quick proto {tcp,udp} from any to any port {6277,27960,27015,27016,27017,27018,27019,27020,27021,27022,28960,23073,23074,23075,23076,23077,37,8767,8766,8768,8769,23083,23082,23081,23080,23079,23078,22222,33333,2499,7777,7878,4000,5000,8020,8010,5689,4359,8555,3333,6666,6100,6113,6112,6200} keep state
pass out quick proto {tcp,udp} from any to any port {6277,27960,27015,27016,27017,27018,27019,27020,27021,27022,28960,23073,23074,23075,23076,23077,37,8767,8766,8768,8769,23083,23082,23081,23080,23079,23078,22222,33333,2499,7777,7878,4000,5000,8020,8010,5689,4359,8555,3333,6666,6100,6113,6112,6200} keep state
pass in proto tcp from any to any port 80 flags S/SA keep state\
(max 999999999, source-track rule, max-src-nodes 999999999, max-src-states 100, tcp.established 300)
pass out proto tcp from any to any port 80 flags S/SA keep state