lan_if = "lan0"
wan_if = "brwan0"

# Default policy
set skip on lo
# Allow all traffic on $wan_if. Proper firewall rules are implemented in the ingress jail.
set skip on $wan_if
set block-policy return
scrub in

# Default block all
block in all

# Allow all outbound traffic
pass out all keep state

# Allow inbound HTTP/HTTPS on lan0
pass in on $lan_if proto tcp from any to ($lan_if) port { 80, 443 } keep state

# Allow SSH only on lan0
pass in on $lan_if proto tcp from any to ($lan_if) port 22 keep state

# Allow all ICMPv6 (required for IPv6 to function correctly)
pass inet6 proto ipv6-icmp from any to any keep state

# Allow all ICMPv4
pass inet proto icmp from any to any keep state