1 #external interface 
   2 EXT = "bge0"
   3 #internal LAN interface
   4 LAN = "bge1"
   5 #IPv4 address of LAN interface
   6 LANip4 = "192.168.1.1"
   7 #IPv6 address of LAN interface
   8 LANip6 = "2001:db8:1:1::1"
   9 #IPv4 address of external interface
  10 EXTip4 = "192.168.2.1
  11 #IPv6 address of external interface
  12 EXTip6 = "2001:db8:1:2::1"
  13 #IPv4 prefix on LAN interface
  14 LANnet4 = "192.168.1.0/24"
  15 #IPv6 prefix on LAN interface
  16 LANnet6 = "2001:db8:1:1::1/64"
  17 #loopback interfaces
  18 Lo4 = "127.0.0.1"
  19 Lo6 = "::1"
  20 #internal server address
  21 LANSRV6="2001:db8:1:2::2"
  22 LANSRV4="192.168.1.2"
  23 # expire state connections early
  24 set optimization aggressive
  25 block in log all
  26 # allow DNS requests to go out
  27 pass out on $EXT inet proto udp from {$EXTip4, $Lo4, $LANnet4} to any port=domain keep state
  28 pass out on $EXT inet6 proto udp from {$EXTip6, $Lo6, $LANnet6} to any port=domain keep state
  29 # all TCP request allowed out
  30 pass out on $EXT inet proto tcp from {EXTip4, $Lo4, $LANnet4} to any keep state
  31 pass out on $EXT inet6 proto tcp from {EXTip6, $Lo6, $LANnet6} to any keep state
  32 # all ping request allowed out
  33 pass out on $EXT inet proto icmp all icmp-type 8 code 0 keep state
  34 pass out on $EXT inet6 proto icmp6 all icmp6-type echoreq keep state
  35 # ND solicitation out
  36 pass out on $EXT inet6 proto icmp6 all icmp6-type {neighbradv, neighbrsol}
  37 # ND advertisement in
  38 pass in on $EXT inet6 proto icmp6 all icmp6-type {neighbradv, neighbrsol}
  39 #router advertisement out
  40 pass out on $LAN inet6 proto icmp6 all icmp6-type routersadv
  41 # router solicitation in
  42 pass in on $LAN inet6 proto icmp6 all icmp6-type routerrsol
  43 # DNS request inside
  44 pass in on $LAN inet proto from $LANnet4 to any port domain
  45 pass in on $LAN inet6 proto from $LANnet6 to any port domain
  46 # TCP request inside
  47 pass in on $LAN inet proto tcp from $LANnet4 to any
  48 pass in on $LAN inet6 proto tcp from $LANnet6 to any
  49 # ICMP request inside
  50 pass in on $LAN inet proto icmp all icmp-type 8 code
  51 pass in on $LAN inet6 proto icmp6 all icmp6-type
  52 #allow incoming connection to SSH server
  53 pass in on $EXT inet6 proto tcp from any to $LANSRV6 port=22 keep-state
  54 pass in on $EXT inet proto tcp from any to $LANSRV4 port=22 keep-state
  55 #all reply from SSH server (does not really necessary)
  56 pass in on $LAN inet6 proto tcp from $LANSRV6 port=22 to any keep-state
  57 pass in on $LAN inet proto tcp from $LANSRV4 port=22 to any keep-state
  58 #allow incoming connection to WWW server
  59 pass in on $EXT inet6 proto tcp from any to $LANSRV6 port=www keep-state
  60 pass in on $EXT inet proto tcp from any to $LANSRV4 port=www keep-state
  61 #all reply from WWW server (does not really necessary)
  62 pass in on $LAN inet6 proto tcp from $LANSRV6 port=www to any keep-state
  63 pass in on $LAN inet proto tcp from $LANSRV4 port=www to any