# macros
my_if = "rl0"
vpn_if = "tun0"
vpn_network = "192.168.1.0/24"
my_network = "192.168.0.0/24"
# Tables
table <abusive> persist
# aliases to be used
tcp_services = "{ 22, 21, 25, 53, 80, 993, 943, 8080, 25000, 1194 }"
udp_services = "{ 53, 1194, 25000 }"
icmp_types = "echoreq"
# blocked private nets I don't use...
priv_nets = "{ 127.0.0.0/8, 172.16.0.0/12, 10.0.0.0/8 }"
# options
set block-policy return
set loginterface $my_if
# scrub
scrub in all
# nat stuff
nat on $my_if from $vpn_network to any -> ($my_if)
nat on $my_if from $my_network to $vpn_network -> ($vpn_if)
# filter rules
#block log all
block in quick from <abusive>
antispoof for $my_if inet
pass quick on lo0 all
pass in on $my_if proto tcp from any to ($my_if) \
port $tcp_services flags S/SA keep state \
(max-src-conn-rate 10/10, overload <abusive> flush global)
pass in on $my_if inet proto udp from any to any \
port $udp_services keep state
pass out on $my_if proto tcp all modulate state flags S/SA
pass out on $my_if proto { udp, icmp } all keep state
block drop in log on $my_if from $priv_nets to any
block drop out log on $my_if from any to $priv_nets
pass in on $my_if proto udp from any to port 25000 keep state
pass in on $vpn_if
pass in on $my_if from 192.168.0.0/24 to any
pass out on $my_if from any to any