Table of illegal adresses forbiden below
table <martians> { 0.0.0.0/8 10.0.0.0/8 127.0.0.0/8 169.254.0.0/16     \
                   172.16.0.0/12 192.0.0.0/24 192.0.2.0/24 224.0.0.0/3 \
                   192.168.0.0/16 198.18.0.0/15 198.51.100.0/24        \
                   203.0.113.0/24 }
#General settings
set block-policy drop
set loginterface egress
set skip on lo0

#NAT settings
match in all scrub (no-df random-id max-mss 1440)
match out on egress inet from !(egress:network) to any nat-to (egress:0)

#General bloking rules
block in quick on egress from <martians> to any
block return out quick on egress from any to <martians>
block all

#Pass all out, pass in on em1 and em2
pass out quick inet
pass in on em1 inet
pass in on em2 inet

#Isolate em1 and em2 from eachother, em2 is DMZ
block in on em1 to em2
block in on em2 to em1

#pass port 32400 in to DMZ for plex
pass in on egress proto tcp from any to any port 443 \
        rdr-to 192.168.138.13 port 32400
