barge# pfctl -s rules
scrub in on tun0 all no-df random-id min-ttl 15 fragment reassemble
block drop in on tun0 all
pass out all keep state
block drop in quick on ! lo inet6 from ::1 to any
block drop in quick on ! lo inet from 127.0.0.0/8 to any
block drop in quick on lo0 inet6 from fe80::1 to any
block drop in quick inet6 from ::1 to any
block drop in quick inet from 127.0.0.1 to any
block drop in quick on ! xl0 inet from 192.168.0.0/24 to any
block drop in quick inet from 192.168.0.2 to any
block drop in quick on ! rl1 inet from 192.168.2.0/24 to any
block drop in quick inet from 192.168.2.2 to any
block drop in quick from <abusive_hosts> to any
block drop in quick on tun0 from <rfc1918> to any
block drop in quick on tun0 from <spammers> to any
pass in quick on tun0 inet proto tcp from any to 192.168.0.3 port = ftp keep state
pass in quick on tun0 inet proto tcp from any to 192.168.0.3 port > 2047 keep state
pass in quick on tun0 inet proto tcp from any to 192.168.0.3 port = 18734 keep state
pass in quick on tun0 inet proto udp from any to 192.168.0.3 port = 18734 keep state
pass in quick on tun0 inet proto tcp from any to 192.168.0.3 port = 55555 keep state
pass in quick on tun0 inet proto udp from any to 192.168.0.3 port = 55555 keep state
pass in quick on tun0 inet proto tcp from any to 192.168.0.3 port 1025:1050 keep state
pass out on tun0 proto tcp all modulate state (if-bound)
pass out on tun0 proto udp all keep state (if-bound)
pass out on tun0 proto icmp all keep state (if-bound)
pass in quick on rl1 all
pass in quick on xl0 all
pass in quick on rl1 inet from 192.168.0.3 to 192.168.0.2
pass in quick on rl1 inet from 192.168.0.5 to 192.168.0.2
pass in quick on rl1 inet from 192.168.2.4 to 192.168.0.2
pass in quick on xl0 inet from 192.168.0.3 to 192.168.0.2
pass in quick on xl0 inet from 192.168.0.5 to 192.168.0.2
pass in quick on xl0 inet from 192.168.2.4 to 192.168.0.2
pass out quick on rl1 inet from 192.168.0.3 to 192.168.0.3
pass out quick on rl1 inet from 192.168.0.3 to 192.168.0.5
pass out quick on rl1 inet from 192.168.0.3 to 192.168.2.4
pass out quick on xl0 inet from 192.168.0.3 to 192.168.0.3
pass out quick on xl0 inet from 192.168.0.3 to 192.168.0.5
pass out quick on xl0 inet from 192.168.0.3 to 192.168.2.4
pass in inet proto icmp all icmp-type echoreq keep state
pass in quick on rl1 proto tcp from any port = bootps to any
pass in quick on rl1 proto udp from any port = bootps to any
pass in quick on tun0 proto tcp from any to (tun0) port = http
pass in quick on tun0 inet proto tcp from any to (tun0) port = ssh modulate state (source-track rule, max-src-conn 8, max-src-conn-rate 3/60, max-src-nodes 8, overload <scanners> flush global, src.track 60)
pass in on tun0 proto tcp from any to any port = ftp keep state