ext_if="ed0"
# external interface linked to the internet
int_if="fxp0"
# internal interface (intranet)
internal_net="192.168.0.1/8"

ports_not_logged="{netbios-ssn,microsoft-ds,epmap,ms-sql-s,5900}"
ports_public_access="{http,ftp}"
## Options :
## Ignore the loopback interface
## On active la normalisation des packets
set skip on lo
scrub in all
## Definition des regles principales du nat
nat on $ext_if from $internal_net to any -> $ext_if
## Interdire le spoofing
antispoof for $ext_if
## On ne bloque pas ce qui sort
pass quick on $int_if
## Par defaut on bloque tout
block in log  on $ext_if  all
On ne logue pas les acces froduleux connus
block in on $ext_if inet proto tcp from any to any \
	  port $ports_not_logged
pass in on $ext_if proto tcp from any to any \
	 port $ports_public_access
pass in on $ext_if inet proto icmp from any to any icmp-type \
	  {echorep,echoreq,timex,unreach}