Something

# start rules
# default policy to block all traffic
block all

# pass in quick is FOR DEBUGGING ONLY
#pass in quick all

# keep out non-routables
block drop in quick on $ext_if from $martians to any
block drop out quick on $ext_if from any to $martians

# activate spoofing protection on all interfaces
block in quick from urpf-failed

# let traffic from inside, reach the outside,
pass out quick inet proto tcp from any to any
pass out quick inet proto udp from any to any
# ftp
pass out proto tcp from 127.0.0.1 to any port 21

# let in SSH to all, we keep this as an explicit rule.. just in case ;)
pass in quick inet proto tcp from any to any port ssh

# allow random FTP ports
pass in quick on $ext_if proto tcp from any to any port > 49151

# pass in tcp_services
pass in inet proto tcp from any to any port $tcp_services synproxy state
pass in inet proto udp from any to any port $udp_services

# ping either direction
pass inet proto icmp all icmp-type $icmp_services

anchor "ftp-proxy/*"
antispoof for $ext_if
antispoof for $int_if0

# don't set this until we assign an ip to  int_if1
#antispoof for $int_if1