#ext_if macro + block by default
ext_if = "vtnet0"
scrub in all
block in on $ext_if

#block known bad hosts table
table <private> const { 10/8, 172.16/12, 192.168/16 }
table <badhosts> persist
block on $ext_if from { <private>, <badhosts> } to any

#allow icmp in and out
pass in inet proto icmp all
pass out inet proto icmp all

#allow SSH from known admins
table <admins> persist file "/usr/local/tyler/admins.pf"
pass in on $ext_if proto tcp from <admins> to $ext_if port 22

#HTTP (80) and HTTPS (443) to the world
pass in on $ext_if proto tcp from any to $ext_if port 80
pass in on $ext_if proto tcp from any to $ext_if port 443

#allow outgoing traffic
pass out on $ext_if proto { tcp, udp } all