Something

set skip on { lo0 }
scrub in all
block drop all
table <blacklist> persist file "/etc/blacklist"
pass out inet proto icmp all icmp-type echoreq keep state
pass in proto tcp from any to any port www flags S/SA synproxy state
pass on fwe0 proto icmp all
pass out on fwe0 proto { tcp,udp } from (fwe0) to any keep state
block on fwe0 from <blacklist> to any
pass on sk0 proto icmp all
pass out on sk0 proto { tcp,udp } from (sk0) to any keep state
block on sk0 from <blacklist> to any