#### INTERFACES
ext_if="re0"
loc_if="lo0"
icmp_types="echoreq"
vpn_if="tun0"

#### ADDRESSES
vpn_addrs4="10.8.0.0/16"
vpn_addrs6="2a01:4f8:d12:d01:8000::/65"
vpn_addrs="{ 10.8.0.0/16 , 2a01:4f8:d12:d01:8000::1/65 }"

# pass and nat traffic from VPN clients
nat pass from $vpn_addrs4 to ! $ext_if -> 88.198.106.11
nat pass log from $vpn_addrs6 to ! $ext_if:network -> 2a01:4f8:d12:d01::10:100


#### FILTERING
block in
pass out quick

pass quick on $vpn_if
# [...]



# natted from VPN
00:00:00.000000 rule 1..16777216/0(match): nat out on tun0: 2a01:4f8:d12:d01::10:100 > 2a01:4f8:d12:d01:8000::1000: ICMP6, neighbor advertisement, tgt is 2a01:4f8:d12:d01:8000::1, length 24

# non-netted from local host
00:00:40.665833 rule 2..16777216/0(match): pass out on re0: 2a01:4f8:d12:d01::10:100.28294 > 2001:8b0:12cc:c087::3.53: Flags [S], seq 2002573705, win 65535, options [mss 1440,nop,wscale 6,sackOK,TS val 1324721132 ecr 0], length 0