####normal begin
block in log on {$ext,$int} all
block out log on {$ext,$int} all
#block spoofers
block in log quick on $ext from <reserved>
pass out log on $int to $lan_clients
##<done>
##allow acces to tcp services
pass out log on $ext inet proto tcp from {($ext),$lan_clients} \
$tcpflags keep state queue (std_out,tcp_ack_out)
pass in log quick on $ext inet proto tcp to ($ext) \
port {4662,6667} $tcpflags keep state
pass in log quick on $ext inet proto tcp to $lan_clients port \
{4662,6667} $tcpflags keep state
###forward some tcp
block in log quick on $ext inet to ! ($ext)
pass out log quick on $int inet proto tcp from ($int) to $lan_clients \
$tcpflags keep state
###allow lan_clients to go outside
pass in log quick on $int inet proto tcp from $lan_clients to ! ($int) \
$tcpflags keep state
### end of tcp rules