# macros.
int_if="xl0"
ext_if="bge0"
allow_nat="{ 139.158.108.12, 139.158.109.154 }"
networks="{ 139.158.108.0/23, 139.158.2.0/24 \
139.158.110.0/24, 139.158.111.0/24, 10.161.15.0/24 }"
# options.
set block-policy return
set skip on lo
set loginterface $ext_if
# scrub.
scrub all
# nat.
nat on $ext_if inet from $allow_nat to any -> ($ext_if:0)
# default policy block.
block all
# antispoof.
antispoof quick for { lo, $int_if }
# pass traffic out to internet.
pass out on $ext_if inet proto tcp all flags S/SA modulate state
pass out on $ext_if inet proto { udp, icmp } all keep state
# allow traffic to internal network.
pass in on $int_if inet from $networks to any
pass out on $int_if inet from any to $networks
# allow icmp ping.
pass in inet proto icmp all icmp-type echoreq keep state