block drop out log on tun1000000 all
block drop in log on tun1000000 all
block return-rst out log on tun1000000 proto tcp all
block return-rst in log on tun1000000 proto tcp all
block return-icmp(port-unr, port-unr) out log on tun1000000 proto udp all
block return-icmp(port-unr, port-unr) in log on tun1000000 proto udp all
block drop out log quick on tun1000000 inet from ! 157.161.48.183 to any
block drop in quick on tun1000000 inet from any to 255.255.255.255
block drop in log quick on tun1000000 inet from 10.0.0.0/8 to any
block drop in log quick on tun1000000 inet from 172.16.0.0/12 to any
block drop in log quick on tun1000000 inet from 192.168.0.0/16 to any
block drop in log quick on tun1000000 inet from 255.255.255.255 to any
pass out on tun1000000 inet proto icmp all icmp-type echoreq code 0 keep state
pass in on tun1000000 inet proto icmp all icmp-type echoreq code 0 keep state
pass out on tun1000000 proto udp all keep state
pass in on tun1000000 proto udp from any to any port = domain keep state
pass out on tun1000000 proto tcp all flags S/SA modulate state
pass in on tun1000000 proto tcp all flags S/SA modulate state
pass in on tun1000000 proto udp all keep state
pass in on tun1000000 proto icmp all keep state
pass in on tun1000000 proto udp all keep state
pass in on tun1000000 proto tcp all flags S/SA synproxy state
pass in on tun1000000 proto icmp all keep state
pass in on tun1000000 proto tcp from any to any port = ssh flags S/SA modulate state
pass in on tun1000000 proto tcp from any to any port = smtp flags S/SA modulate state
pass in on tun1000000 proto tcp from any to any port = domain flags S/SA modulate state
pass in on tun1000000 proto tcp from any to any port = auth flags S/SA modulate state