include "local.conf"

set block-policy drop
set loginterface external

set skip on lo0
set skip on lo

# Unroutable networks:
table <v4_priv_nets> { 127.0.0.0/8 192.168.0.0/16 172.16.0.0/12 10.0.0.0/8 192.88.99.0/24 198.18.0.0/15 }

table <priv_nets> { 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8, 192.88.99.0/24 198.18.0.0/15 2001:db8::/32 3fff::/20 }

nat on $external_card inet from !($external_card) -> ($external_card:0)
nat-anchor "ftp-proxy/*"
rdr-anchor "ftp-proxy/*"

block drop in quick on external from <priv_nets>

block drop in quick from <junk> # User defined junk table
block drop out quick to <junk> # User defined junk table

# Scrub stuff via a matchrule:
match in all scrub ( random-id reassemble tcp fragment reassemble )


# Start with a paranoid default:
block all

# ICMP is important, don't block it
pass proto { icmp ipv4-icmp } keep state

# DHCPv4 from ISP
pass in quick on external inet proto udp to (external) port { 67, 68 }

pass out all

antispoof for internal
antispoof for external

pass in on internal all