$ cat pf.conf
ext_if="bge0"
int_if="bge1"
dmz_if="nfe0"
openvpn_if="tun0"
carp=" bge0 bge1 nfe0 "
pfsync="nfe1"

#table <spamd-white> persist
table <bruteforce> persist

set skip on lo
set block-policy return

#scrub in
nat on $ext_if from (carp1) -> (carp0:0)
rdr pass on $ext_if proto tcp from any to any port ssh \
        -> 127.0.0.1 port ssh
rdr pass on $ext_if proto { tcp udp } from any to any port domain \
        -> 127.0.0.1 port domain
rdr pass on $int_if proto { tcp udp } from any to any port domain \
        -> 127.0.0.1 port domain
rdr pass on $ext_if proto tcp from any to any port time \
        -> 127.0.0.1 port time

pass quick on $pfsync proto pfsync
pass quick on { $carp } proto carp

block in on $ext_if
pass in on $int_if
pass in on $dmz_if to ! $int_if:network
pass in proto icmp all label "in"
pass out keep state

$ cat ifconfig.carp 
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 33168
        groups: lo
        inet 127.0.0.1 netmask 0xff000000
        inet6 ::1 prefixlen 128
        inet6 fe80::1%lo0 prefixlen 64 scopeid 0x6
nfe0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
        lladdr 00:16:36:76:17:3b
        description: dmz
        media: Ethernet autoselect (1000baseT full-duplex,master)
        status: active
        inet 172.17.254.254 netmask 0xffffff00 broadcast 172.17.254.255
        inet6 fe80::216:36ff:fe76:173b%nfe0 prefixlen 64 scopeid 0x1
nfe1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
        lladdr 00:16:36:76:17:3c
        description: pfsync
        media: Ethernet autoselect (1000baseT full-duplex)
        status: active
        inet 172.17.128.254 netmask 0xffffff00 broadcast 172.17.128.255
        inet6 fe80::216:36ff:fe76:173c%nfe1 prefixlen 64 scopeid 0x2
bge0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
        lladdr 00:16:36:76:17:39
        description: external gateway
        media: Ethernet autoselect (1000baseT full-duplex,rxpause,txpause)
        status: active
        inet6 fe80::216:36ff:fe76:1739%bge0 prefixlen 64 scopeid 0x3
bge1: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
        lladdr 00:16:36:76:17:3a
        description: internal gateway
        media: Ethernet autoselect (1000baseT full-duplex,rxpause,txpause)
        status: active
        inet 172.17.1.254 netmask 0xffffff00 broadcast 172.17.1.255
        inet6 fe80::216:36ff:fe76:173a%bge1 prefixlen 64 scopeid 0x4
enc0: flags=0<> mtu 1536
pfsync0: flags=41<UP,RUNNING> mtu 1460
        pfsync: syncdev: nfe1 syncpeer: 224.0.0.240 maxupd: 128
        groups: carp pfsync
pflog0: flags=141<UP,RUNNING,PROMISC> mtu 33168
        groups: pflog
carp0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
        lladdr 00:00:5e:00:01:01
        description: carp external gateway
        carp: MASTER carpdev bge0 vhid 1 advbase 1 advskew 0
        groups: carp egress
        inet6 fe80::200:5eff:fe00:101%carp0 prefixlen 64 scopeid 0x8
        inet 204.16.153.246 netmask 0xfffffffc broadcast 204.16.153.247
carp1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
        lladdr 00:00:5e:00:01:01
        description: carp internal gateway
        carp: MASTER carpdev bge1 vhid 1 advbase 1 advskew 0
        groups: carp
        inet6 fe80::200:5eff:fe00:101%carp1 prefixlen 64 scopeid 0x9
        inet 172.17.1.1 netmask 0xffffff00 broadcast 172.17.1.255
carp2: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
        lladdr 00:00:5e:00:01:02
        description: carp dmz
        carp: MASTER carpdev nfe0 vhid 2 advbase 1 advskew 0
        groups: carp
        inet6 fe80::200:5eff:fe00:102%carp2 prefixlen 64 scopeid 0xa
        inet 172.17.254.1 netmask 0xffffff00 broadcast 172.17.254.255


$  cat netstat.carp 
Routing tables

Internet:
Destination        Gateway            Flags    Refs      Use    Mtu  Interface
default            204.16.153.245     UGS         0        0      -   carp0
127/8              127.0.0.1          UGRS        0        0  33168   lo0
127.0.0.1          127.0.0.1          UH          0        0  33168   lo0
172.17.1/24        link#4             UC          0        0      -   bge1
172.17.1.1         172.17.1.1         UH          0        0      -   carp1
172.17.1.16        00:04:f2:15:04:4f  UHLc        0        0      -   bge1
172.17.128/24      link#2             UC          0        0      -   nfe1
172.17.254/24      link#1             UC          0        0      -   nfe0
172.17.254.1       172.17.254.1       UH          0        0      -   carp2
204.16.153.244/30  link#8             UC          0        0      -   carp0
204.16.153.245     00:01:97:36:b4:0a  UHLc        0        0      -   carp0
224/4              127.0.0.1          URS         0        0  33168   lo0


$ cat pfctl.carp 
TRANSLATION RULES:
nat on bge0 from (carp1) to any -> (carp0:0)
rdr pass on bge0 inet proto tcp from any to any port = ssh -> 127.0.0.1 port 22
rdr pass on bge0 inet proto tcp from any to any port = domain -> 127.0.0.1 port 53
rdr pass on bge0 inet proto udp from any to any port = domain -> 127.0.0.1 port 53
rdr pass on bge1 inet proto tcp from any to any port = domain -> 127.0.0.1 port 53
rdr pass on bge1 inet proto udp from any to any port = domain -> 127.0.0.1 port 53
rdr pass on bge0 inet proto tcp from any to any port = time -> 127.0.0.1 port 37

FILTER RULES:
pass quick on bge0 proto carp all keep state
pass quick on bge1 proto carp all keep state
pass quick on nfe0 proto carp all keep state
pass quick on nfe1 proto pfsync all keep state
block return in on bge0 all
pass in on bge1 all flags S/SA keep state
pass in on nfe0 inet from any to ! 172.17.1.0/24 flags S/SA keep state
pass in proto icmp all keep state label "in"
pass out all flags S/SA keep state
pass quick on bge1 all no state label "local-nic" queue(def_in, pri_in)
pass quick on tun0 all no state label "local-nic" queue(def_in, pri_in)
pass quick on bge0 all no state label "local-nic" queue(def_in, pri_in)
pass quick on bge1 all no state label "local-nic" queue(def_in, pri_in)
pass quick on nfe0 all no state label "local-nic" queue(def_in, pri_in)
block drop in quick on ! lo inet from 127.0.0.0/8 to any
block drop in quick on ! lo inet6 from ::1 to any
block drop in quick inet from 127.0.0.1 to any
block drop in quick on ! bge1 inet from 172.17.1.0/24 to any
block drop in quick inet from 172.17.1.254 to any
block drop in quick inet6 from ::1 to any
block drop in quick on lo0 inet6 from fe80::1 to any
block drop in quick on bge1 inet6 from fe80::216:36ff:fe76:173a to any
pass in on bge0 proto tcp from any to (bge0) port = ssh flags S/SA keep state label "ssh-in" queue(def_in, pri_in)
pass in log on bge0 proto tcp from any to (bge0) port = smtp flags S/SA keep state
pass out log on bge0 proto tcp from (bge0) to any port = smtp flags S/SA keep state
pass in on bge0 proto tcp from any to any port = 1194 flags S/SA keep state label "openvpn" queue(def_in, pri_in)
pass in on bge0 proto udp from any to any port = 1194 keep state label "openvpn" queue(def_in, pri_in)
No queue in use

STATES:
all pfsync 172.17.128.254 -> 224.0.0.240       SINGLE:NO_TRAFFIC
all carp 204.16.153.246 -> 224.0.0.18       SINGLE:NO_TRAFFIC
all carp 172.17.1.254 -> 224.0.0.18       SINGLE:NO_TRAFFIC
all udp 127.0.0.1:53 <- 172.17.1.1:53 <- 172.17.1.148:35926       MULTIPLE:MULTIPLE
all udp 127.0.0.1:53 <- 172.17.1.1:53 <- 172.17.1.156:47836       MULTIPLE:MULTIPLE
all carp 172.17.254.254 -> 224.0.0.18       SINGLE:NO_TRAFFIC
all udp 127.0.0.1:53 <- 172.17.1.1:53 <- 172.17.1.213:32865       MULTIPLE:MULTIPLE
all udp 127.0.0.1:53 <- 172.17.1.1:53 <- 172.17.1.152:40327       MULTIPLE:MULTIPLE
all udp 127.0.0.1:53 <- 172.17.1.1:53 <- 172.17.1.160:57819       SINGLE:MULTIPLE

INFO:
Status: Enabled for 0 days 00:02:01           Debug: Urgent

State Table                          Total             Rate
  current entries                        9               
  searches                           68131          563.1/s
  inserts                               93            0.8/s
  removals                              84            0.7/s
Counters
  match                              67264          555.9/s
  bad-offset                             0            0.0/s
  fragment                               0            0.0/s
  short                                  0            0.0/s
  normalize                              0            0.0/s
  memory                                 0            0.0/s
  bad-timestamp                          0            0.0/s
  congestion                             0            0.0/s
  ip-option                              2            0.0/s
  proto-cksum                            0            0.0/s
  state-mismatch                         0            0.0/s
  state-insert                           0            0.0/s
  state-limit                            0            0.0/s
  src-limit                              0            0.0/s
  synproxy                               0            0.0/s

LABEL COUNTERS:
in 30582 0 0 0 0 0 0
local-nic 67171 3792 282105 3595 267145 197 14960
local-nic 63377 0 0 0 0 0 0
local-nic 63377 63376 3625228 26985 1479389 36391 2145839
local-nic 1 0 0 0 0 0 0
local-nic 1 1 72 0 0 1 72
ssh-in 0 0 0 0 0 0 0
openvpn 0 0 0 0 0 0 0
openvpn 0 0 0 0 0 0 0

TIMEOUTS:
tcp.first                   120s
tcp.opening                  30s
tcp.established           86400s
tcp.closing                 900s
tcp.finwait                  45s
tcp.closed                   90s
tcp.tsdiff                   30s
udp.first                    60s
udp.single                   30s
udp.multiple                 60s
icmp.first                   20s
icmp.error                   10s
other.first                  60s
other.single                 30s
other.multiple               60s
frag                         30s
interval                     10s
adaptive.start             6000 states
adaptive.end              12000 states
src.track                     0s

LIMITS:
states        hard limit    10000
src-nodes     hard limit    10000
frags         hard limit     5000
tables        hard limit     1000
table-entries hard limit   200000

TABLES:
bruteforce

OS FINGERPRINTS:
696 fingerprints loaded