set block-policy drop
set limit states 900000000
set optimization normal
scrub in all
antispoof for dc0 inet
antispoof for dc1 inet
set skip on lo0
block in log all
block out log all
block drop in quick on dc0 from any os { SCO, NMAP }
block drop in quick on dc1 from any os { SCO, NMAP }
pass in quick proto tcp from any to any port {443,21,22,25,110,465,587,993,995,996,2082,2086,2087,2095,2096,81,43,2089,3389,4643,113,57214,37240,1313,28748,1863,902} flags S/SA keep state
pass out quick proto tcp from any to any port {443,21,22,25,110,465,587,993,995,996,2082,2086,2087,2095,2096,81,43,2089,3389,4643,113,57214,37240,1313,28748,1863,902} flags S/SA keep state
pass in quick proto {tcp,udp} from any to any port {6277,27960,27016,27017,27018,27019,27020,27021,27022,28960,23073,23074,23075,23076,23077,37,8767,8766,8768,8769,23083,23082,23081,23080,23079,23078,22222,33333,2499,7777,7878,4000,5000,8020,8010,5689,4359,8555,3333,6666,6100,6113,6112,6200} keep state
pass out quick proto {tcp,udp} from any to any port {6277,27960,27016,27017,27018,27019,27020,27021,27022,28960,23073,23074,23075,23076,23077,37,8767,8766,8768,8769,23083,23082,23081,23080,23079,23078,22222,33333,2499,7777,7878,4000,5000,8020,8010,5689,4359,8555,3333,6666,6100,6113,6112,6200} keep state
pass in proto tcp from any to any port 80 flags S/SA keep state\
(max 999999999, source-track rule, max-src-nodes 999999999, max-src-states 100, tcp.established 300)
pass out proto tcp from any to any port 80 flags S/SA keep state
pass in quick proto {udp, tcp} from any to any port {27015, 27016, 27017, 27005} flags S/SA keep state
pass out quick proto {udp, tcp} from any to any port {27015, 27016, 27017, 27005} flags S/SA keep state
pass in quick proto {tcp, udp} from any to any port > 1025 keep state
pass out quick proto {tcp, udp} from any to any port > 1025 keep state
pass in quick proto {tcp,udp} from any to any port 53 keep state
pass out quick proto {tcp,udp} from any to any port 53 keep state