00100 check-state :KS
00200 allow src-port 22
00300 allow in dst-port 22 dst-ip lookup src-ip t_ssh
00400 deny in dst-port 22
00500 deny in dst-ip lookup src-ip t_pouilleux
00600 allow { proto ipv6-icmp or proto icmp }
00700 allow via lo0
00800 allow { proto ah or proto esp }
00900 allow in dst-port 53 dst-ip lookup dst-ip t_ovh112 keep-state :KS
01000 allow in dst-port 53,5232,7070 dst-ip lookup src-ip t_unbound keep-state :KS
01100 allow in dst-port 25,465,993,2525,10027,10028 dst-ip lookup src-ip t_ssh keep-state :KS
01200 deny in dst-ip6 2001:41d0:203:184e::118
01300 allow in dst-port 25,587,993,80,443 keep-state :KS
01400 allow out keep-state :KS // after NAT
01500 deny log in
65535 deny ip from any to any