rtr_startups

icmp_types = "{ echoreq, unreach }"
rfc1918 = "{ 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 }"
set skip on lo
block in quick from urpf-failed
anchor "oubound" on vic0 {
        pass in inet proto tcp to port { ssh www https } tag GOOD
        pass in inet from vic1:network tag GOOD
        pass inet proto icmp icmp-type $icmp_types tag GOOD
        pass out inet from self to any keep state tag GOOD
        pass out inet from vic1:network nat-to (egress:0) tag GOOD
        block log quick ! tagged GOOD
        }
anchor "inbound" on vic1 {
        pass inet proto icmp icmp-type $icmp_types tag GOOD
        pass out inet # nat-to vic0:0 tag GOOD
        pass out quick inet from vic1:network to 172.30.2.0/24 tag GOOD
        pass out quick inet proto udp from vic1:network to 8.8.8.8 tag GOOD
        pass inet from vic1:network tag GOOD
        block out inet from vic1:network to $rfc1918 tag GOOD
        block log quick ! tagged GOOD
        }