table <invalid> const { 0.0.0.0 255.255.255.255 127.0.0.0/8 192.168.0.0/16 172.16.0.0/12 10.0.0.0/8 }
table <SSHscan> persist
table <admins> persist { 210.207.212.64 82.153.171.11 217.35.91.73 38.99.129.38 }
table <ircIPs> persist { 208.53.150.228 }
scrub all
altq on fxp0 priq bandwidth 100Mb queue { ftp_out, mail_out, www_out, irc_out, ssh_out }
# Defaults
pass quick on lo0
block in all
pass out on fxp0 inet proto tcp from (fxp0) to any port $ftp_ports
pass out all keep state
# Block quick invalid/bad incoming stuff
block in quick from <invalid>
block in quick to <invalid>
# Pass generic incoming stuff
pass in on fxp0 proto tcp to <me> port { = 20,21 } keep state queue ftp
pass in on fxp0 proto tcp to <me> port { = 25,110 } keep state queue mail
pass in on fxp0 proto tcp to <me> port { = 80,443,2222,10000 } keep state queue www
pass in on fxp0 proto tcp to <me> port { = 53,60,80,110,113,123,2401,3690 } keep state queue misc
pass in on fxp0 proto udp to <me> port = 53 keep state misc
pass in on fxp0 inet proto icmp all icmp-type { 0,3,11 } keep state
pass in on fxp0 proto tcp to <me> port 49151 >< 65535 keep state queue ftp
# Pass IRC ports to IRC IPs only
block in on fxp0 proto tcp to <me> port 6660:7001
pass in on fxp0 proto tcp to <ircIPs> port 6660:7001 keep state irc
# Extra fortification for ssh
pass in on fxp0 proto tcp to <me> port = 22 flags S/SAFR \
keep state queue ssh (source-track rule,max-src-conn-rate 10/60,overload <SSHscan> flush)
block in on fxp0 proto tcp from <SSHscan> to <me> port = 22
pass in on fxp0 proto tcp from <admins> to <me> port = 22 keep state queue ssh