ext_if="bge0"
int_if="bge1"
dmz_if="nfe0"
openvpn_if="tun0"
carp=" bge0 bge1 nfe0 "
pfsync="nfe1"

#table <spamd-white> persist
table <bruteforce> persist

set skip on lo
set block-policy return

#scrub in
nat on $ext_if from (carp1) -> (carp0:0)
rdr pass on $ext_if proto tcp from any to any port ssh \
        -> 127.0.0.1 port ssh
rdr pass on $ext_if proto { tcp udp } from any to any port domain \
        -> 127.0.0.1 port domain
rdr pass on $int_if proto { tcp udp } from any to any port domain \
        -> 127.0.0.1 port domain
rdr pass on $ext_if proto tcp from any to any port time \
        -> 127.0.0.1 port time

pass quick on $pfsync proto pfsync
pass quick on { $carp } proto carp

block in on $ext_if
pass in on $int_if
pass in on $dmz_if to ! $int_if:network
pass in proto icmp all label "in"
pass out keep state