add 100 allow all from any to any via lo0 // allow loopback out
add 200 deny all from any to any frag // deny fragmented packets
add 1000 divert natd all from any to any in via rl0 // allow outbound lan traffic
add 4900 deny icmp from any to any in via rl1 icmptypes 8 // deny incoming ping requests
add 5000 check-state // dynamic rule
add 5100 allow all from any to any out via rl1 keep-state // allow all established traffic
add 65000 deny all from any to any // default to deny cleanup rule