logopt = "log"
# interfaces
ext_if  = "bge0"
wifi_if = "ath0"
#lan_if  = "fxp1"
# publically accesible services (transport layer neutral)
pubserv = "{ 80, 443 }"
# internally accessible services (transport layer neutral)
lanserv = "{ 22, 53, 67, 80, 443 }"
# samba ports (transport layer neutral)
#samba_ports = "{ 137, 138, 139 }"
# externally permitted inbound icmp types
icmp_types = "echoreq"
# internal network
lan_net = "192.168.0.0/24"

# block these networks
table <badnetz>  { 0.0.0.0/8, 10.0.0.0/8, 20.20.20.0/24, 127.0.0.0/8, \
        169.254.0.0/16, 172.16.0.0/12,  192.0.2.0/24, 192.168.0.0/16, \
        224.0.0.0/3,    255.255.255.255 }
#------------------------------------------------------------------------
# options
#------------------------------------------------------------------------
# config
set block-policy return
set loginterface $ext_if
set skip on lo0
# scrub
#scrub all reassemble tcp no-df
#scrub in all fragment reassemble
scrub out all random-id

nat on $ext_if from $lan_net to any -> ($ext_if)
pass in  quick on lo0 all
pass out quick on lo0 all
pass in  quick all
pass out from any to any keep state