block in from any to any
block out from any to any
# pass all outgoing packets on internal interface
# pass in quick any packets destined for the gateway itself
pass in on $int_if from $lan_net to any port $important
pass in on $int_if from $lan_net to any port $game_ports
pass in quick on $int_if from $lan_net to $int_if
# packet filtering
pass in on $int_if route-to \
{ ($adsl_if $adsl_gw), ($sdsl_if $sdsl_gw) } round-robin sticky-address\
proto tcp from $lan_net to any port $important \
flags S/SA modulate state
pass in on $int_if route-to \
{ ($adsl_if $adsl_gw), ($sdsl_if $sdsl_gw) } round-robin sticky-address\
proto tcp from $lan_net to any port $game_ports \
flags S/SA modulate state
pass in on $int_if route-to \
{ ($adsl_if $adsl_gw), ($sdsl_if $sdsl_gw) } round-robin sticky-address\
proto {udp, icmp} from $lan_net to any port \
keep state
block out on $int_if all
pass out on $int_if proto {udp,tcp,icmp} from any port to $lan_net \
pass out on $adsl_if route-to ($sdsl_if $sdsl_gw) from $sdsl_if to any
pass out on $sdsl_if route-to ($adsl_if $adsl_gw) from $adsl_if to any
# but don't allow spoofed stuff
block quick on $int_if proto tcp from 192.168.1.204 to any
antispoof quick for {$int_if }