ext_if="vtnet0"
NET_JAIL="{ 192.168.69.0/24 192.168.68.0/24 192.168.0.0/24 }"

jails_if="{ epair0a epair1a epair2a }"

scrub in all

# Won't filter traffic on loopback
set skip on lo0

# nat all jail traffic
nat on $ext_if inet from any to any -> ($ext_if)

# Protects against activity from spoofed or forged IPs
antispoof for $ext_if inet

# Allow SSH/d
pass in quick on $ext_if proto tcp from any to any port ssh

# Allow traceroute
pass out on $ext_if inet proto udp from any to any port 33433 >< 33626 keep state

# Allow ICMP ping
pass inet proto icmp from any to any

# Allow all OUT, block all IN
block in
pass out