ext_if="bge0"
int_if="bge1"
dmz_if="nfe0"
openvpn_if="tun0"
carp=" bge0 bge1 nfe0 "
pfsync="nfe1"
#table <spamd-white> persist
table <bruteforce> persist
set skip on lo
set block-policy return
#scrub in
nat on $ext_if from (carp1) -> (carp0:0)
rdr pass on $ext_if proto tcp from any to any port ssh \
-> 127.0.0.1 port ssh
rdr pass on $ext_if proto { tcp udp } from any to any port domain \
-> 127.0.0.1 port domain
rdr pass on $int_if proto { tcp udp } from any to any port domain \
-> 127.0.0.1 port domain
rdr pass on $ext_if proto tcp from any to any port time \
-> 127.0.0.1 port time
pass quick on $pfsync proto pfsync
pass quick on { $carp } proto carp
block in on $ext_if
pass in on $int_if
pass in on $dmz_if to ! $int_if:network
pass in proto icmp all label "in"
pass out keep state