tcp_services="{ ssh, http }"
icmp_types="echoreq"
syn_only="S/FSRA"
ext_if="em0"

set block-policy drop
set loginterface $ext_if
set skip on lo

scrub in all

anchor "incoming" in on $ext_if {
  pass quick inet6 proto icmp6 keep state
  pass quick inet proto icmp all icmp-type $icmp_types keep state
  pass quick proto tcp to port $tcp_services flags $syn_only keep state
}

anchor "outgoing" out on $ext_if {
  pass quick keep state
}

block in log
block out log