wan="em0"
wan2="igc0"
lan="em1"
admin="em2"
wifi="vlan4"
guests="vlan6"
iot="vlan10"
vpn="vlan20"
nas="vlan30"
all_int_if="em1 em2 vlan4 vlan6 vlan10 vlan20 vlan30"
all_inc_if="em0 igc0 em1 em2 vlan4 vlan6 vlan10 vlan20 vlan30"
DNS_Bachelors="{ em1 em2 vlan4 vlan6 vlan10 vlan20 vlan30 }"
Unsafe_Networks_LAN="{vlan4:network vlan6:network vlan10:network vlan20:network vlan30:network em2:network}"
Unsafe_Networks_WIFI="{vlan6:network vlan10:network vlan20:network vlan30:network em2:network}"
Unsafe_Networks_Admin="{vlan4:network vlan6:network vlan10:network vlan20:network vlan30:network}"
Unsafe_Networks_IoT="{vlan6:network vlan20:network vlan30:network em2:network}"
Unsafe_Networks_Guests="{vlan10:network vlan20:network vlan30:network em2:network}"
Unsafe_Networks_NAS="{vlan6:network vlan10:network vlan20:network em2:network}"
Unsafe_Networks_VPN="{vlan6:network vlan10:network vlan30:network em2:network}"
DNS_Network="{192.168.0.3 192.168.0.5 192.168.0.4 192.168.0.6 192.168.0.15}"
DNS_Ports="{53 853 5353}"
TCP_Services = "{ 53 68 80 88 110 123 443 465 500 546 853 993 1024:65535 }"
UDP_Services = "{ 53 68 80 88 123 443 500 546 853 1024:65535 }"
XBOX_Ports="{53 80 88 500 3074 3544 4500}"
XBOX="{192.168.10.22}"
PiVPN="{20.20.20.2}"
DNS_Set_1="{192.168.0.6 192.168.0.4}"
DNS_Set_2="{192.168.0.3 192.168.0.5}"
NAS_1="{192.168.30.251 192.168.30.51 192.168.30.253}"
NAS1_Ports="{7 9 443 1024:65535}"
Anti_Lockout_Ports="{22}"
PC_Group="{192.168.0.10:192.168.0.13}"
VPN_Ports="{22 443}"
WIFI_MDNS_Networks="{192.168.30.0/24 192.168.10.0/24 20.20.20.0/24}"
table <martians> { 0.0.0.0/8 10.0.0.0/8 127.0.0.0/8 169.254.0.0/16     \
	 	   172.16.0.0/12 192.0.0.0/24 192.0.2.0/24 224.0.0.0/3 \
	 	   192.168.0.0/16 198.18.0.0/15 198.51.100.0/24        \
	 	   203.0.113.0/24 }
set block-policy drop
set loginterface egress
set skip on {lo em3}
set timeout { udp.first 300, udp.single 150, udp.multiple 900 }
set timeout { adaptive.start 10000, adaptive.end 45000 }
set syncookies adaptive (start 60%, end 30%)
match in all scrub  (no-df random-id max-mss 1440)
match out on egress from !(egress:network) to any nat-to (egress:0)
antispoof quick for { egress $all_int_if }
block in quick on egress from <martians> to any
block return out quick on egress from any to <martians>
block log all 
pass out quick 
pass in on { $all_int_if self}
pass in on egress inet6 proto icmp6 all \
  icmp6-type { routeradv neighbrsol neighbradv }
pass in on egress inet6 proto udp \
  from fe80::/10 port dhcpv6-server \
  to fe80::/10 port dhcpv6-client \
  no state
pass in on egress inet6 proto udp from fe80::/10 port dhcpv6-server \
  to fe80::/10 port dhcpv6-client no state
pass out on egress inet6 proto udp from any to any port 33433 >< 33626 keep state
pass in on $wan inet6 proto udp from fe80::/10 port dhcpv6-server \
  to fe80::/10 port dhcpv6-client no state
pass on any inet6 proto icmp6 all
#block in quick on $lan from $Unsafe_Networks_LAN to $lan:network
#block quick on $admin from $Unsafe_Networks_Admin to $admin:network
#block in quick on $wifi from $Unsafe_Networks_WIFI to $wifi:network
#block quick on $guests from $Unsafe_Networks_Guests to $guests:network
#block quick on $iot from $Unsafe_Networks_IoT to $iot:network
#block quick on $vpn from $Unsafe_Networks_VPN to $vpn:network
#block quick on $nas from $Unsafe_Networks_NAS to $nas:network
#pass in on egress inet proto tcp from any to (egress) port { 80 443 } rdr-to 192.168.1.2
