pf ruleset

ext_if="nve0"
int_if="ath0"
icmp_types="echoreq"

set block-policy return
set loginterface $ext_if
set skip on lo
set skip on lo0

scrub in

nat on $ext_if from !($ext_if) -> ($ext_if:0)

block in

pass out keep state

antispoof quick for { lo $int_if }

pass in inet proto icmp all icmp-type $icmp_types keep state

pass quick on $int_if