scrub in all fragment reassemble
block drop log all
block drop log quick from <defaultdrop> to any
block drop log quick proto icmp from <dropicmp> to any
block drop in log quick on hme1 from <IPSpoof-LAN> to any
block drop in log quick on hme1 from <IPSpoof-WLAN> to any
block drop in log quick on hme1 from <IPSpoof-DMZ1> to any
block drop in log quick on hme1 from <IPSpoof-DMZ2> to any
block drop in log quick on hme1 from <IPSpoof-DMZ3> to any
block drop in log quick on ! hme2 from <IPSpoof-LAN> to any
block drop in log quick from (hme2) to any
block drop in log quick on ! hme3 from <IPSpoof-WLAN> to any
block drop in log quick from (hme3) to any
block drop in log quick on ! hme4 from <IPSpoof-DMZ1> to any
block drop in log quick from (hme4) to any
block drop in log quick on ! hme5 from <IPSpoof-DMZ2> to any
block drop in log quick from (hme5) to any
block drop in log quick on ! hme6 from <IPSpoof-DMZ3> to any
block drop in log quick from (hme6) to any
pass log quick from <firewall> to any keep state
pass log quick inet proto icmp from ! <LocalNetworks> to (hme1) icmp-type echoreq keep state
pass log quick inet proto tcp from any to 192.168.3.2 port = www keep state
pass log quick inet proto icmp from <IPSpoof-LAN> to any icmp-type echoreq keep state
pass log quick inet proto udp from <IPSpoof-LAN> to any port 33000 >< 33999 keep state
pass log quick from <IPSpoof-LAN> to <IPSpoof-WLAN> keep state
pass log quick inet proto tcp from <IPSpoof-WLAN> to <firewall> port = ssh keep state
pass log quick inet proto tcp from <IPSpoof-WLAN> to 192.168.1.101 port = ssh keep state
pass log quick inet proto tcp from <IPSpoof-WLAN> to 192.168.1.101 port = www keep state
pass log quick proto udp from <IPSpoof-LAN> to <DNS-Servers> port = domain keep state
pass log quick from <IPSpoof-LAN> to ! <LocalNetworks> keep state
pass log quick from <IPSpoof-LAN> to <IPSpoof-DMZ1> keep state
pass log quick from <IPSpoof-DMZ1> to ! <LocalNetworks> keep state
pass log quick proto udp from <IPSpoof-WLAN> to <DNS-Servers> port = domain keep state
pass log quick from <IPSpoof-WLAN> to ! <LocalNetworks> keep state
pass log quick inet proto udp from 172.16.1.0/24 to <DNS-Servers> port = domain keep state
pass log quick inet from 172.16.1.0/24 to ! <LocalNetworks> keep state
pass log quick proto tcp from <IPSpoof-LAN> to (hme2) port = ssh keep state
pass log quick proto tcp from <IPSpoof-LAN> to (hme2) port = 8021 keep state
pass log quick proto tcp from ! <LocalNetworks> to (hme1) port = ssh keep state (source-track rule, max-src-conn-rate 1/60, src.track 60)
anchor "ftp-proxy/*" all
pass out proto tcp from <firewall> to any port = ftp keep state
block drop log quick from any to <firewall>