# TABLES & LISTS
table <suspended> persist

# POLICY
set skip on lo
block all

# BLOCKLIST
block in quick on vio0 from <suspended>
block out quick on vio0 to <suspended>

# IN
match in all scrub (no-df random-id)
pass in on vio0 proto { icmp icmp6 } to any
pass in on vio0 proto tcp from ! self to any port { 22 70 79 80 443 } keep state \
        (max-src-conn 20, max-src-conn-rate 10/5, overload <suspended> flush global)

# OUT
pass out on vio0 from any to any keep state
pass out on vio0 proto tcp user "_tor" keep state \
         (max-src-conn 10, max-src-conn-rate 30/20)