ext_if = "ral0"
int_if = "{ vr0, vr1, vr2, vr3 }"

tcp_services="{ ssh, auth, www, https }"
icmp_types="echoreq"

set block-policy return
#set loginterface $ext_if

set skip on lo

scrub in

# nat
nat on $ext_if from !($ext_if) -> ($ext_if:0)

# block everything by default
block in log all

pass out

antispoof quick for $int_if
antispoof quick for lo

pass in on $ext_if inet proto tcp from any to ($ext_if) port $tcp_services

pass in inet proto icmp all icmp-type $icmp_types

# pass trusted nets
pass quick on $int_if