ext_if = "ral0"
int_if = "{ vr0, vr1, vr2, vr3 }"
tcp_services="{ ssh, auth, www, https }"
icmp_types="echoreq"
set block-policy return
#set loginterface $ext_if
set skip on lo
scrub in
# nat
nat on $ext_if from !($ext_if) -> ($ext_if:0)
# block everything by default
block in log all
pass out
antispoof quick for $int_if
antispoof quick for lo
pass in on $ext_if inet proto tcp from any to ($ext_if) port $tcp_services
pass in inet proto icmp all icmp-type $icmp_types
# pass trusted nets
pass quick on $int_if