#

# Only allow TCP packets in/out of le0 if there is an outgoing connection setup

# somewhere, waiting for it.

#

pass out quick on le0 proto tcp from any to any flags S/SAFR keep state

block out on le0 proto tcp all

block in on le0 proto tcp all

#

# allow nameserver queries and replies to pass through, but no other UDP

#

pass out quick on le0 proto udp from any to any port = 53 keep state

block out on le0 proto udp all

block in on le0 proto udp all