### macros ###
ext_if="sk0"
int_if="ath0"
int_net="192.168.0.0/24"
### options ###
set skip on lo0
### scrub ###
scrub all no-df fragment reassemble random-id
### nat ###
nat on $ext_if from $int_net to any -> $ext_if
### filter rules ###
# block/log everything.
block log all
# allow all traffic on $int_if.
pass on $int_if
# allow ping in.
pass in quick inet proto icmp all icmp-type echoreq keep state
# allow dns in.
pass in quick on $ext_if inet proto { tcp, udp } from any to any \
port domain modulate state flags S/SA
# allow ftp, http, ssh, smtp, pop3 in.
pass in quick on $ext_if inet proto tcp from any to any \
port { ftp, ftp-data, http, 2022, smtp, pop3, >49151 } modulate state flags S/SA
# allow all tcp, udp and icmp pass out.
pass out quick on $ext_if inet proto { tcp, udp, icmp } all \
modulate state flags S/SA