1*7c478bd9Sstevel@tonic-gate# 2*7c478bd9Sstevel@tonic-gate# Only allow TCP packets in/out of le0 if there is an outgoing connection setup 3*7c478bd9Sstevel@tonic-gate# somewhere, waiting for it. 4*7c478bd9Sstevel@tonic-gate# 5*7c478bd9Sstevel@tonic-gatepass out quick on le0 proto tcp from any to any flags S/SAFR keep state 6*7c478bd9Sstevel@tonic-gateblock out on le0 proto tcp all 7*7c478bd9Sstevel@tonic-gateblock in on le0 proto tcp all 8*7c478bd9Sstevel@tonic-gate# 9*7c478bd9Sstevel@tonic-gate# allow nameserver queries and replies to pass through, but no other UDP 10*7c478bd9Sstevel@tonic-gate# 11*7c478bd9Sstevel@tonic-gatepass out quick on le0 proto udp from any to any port = 53 keep state 12*7c478bd9Sstevel@tonic-gateblock out on le0 proto udp all 13*7c478bd9Sstevel@tonic-gateblock in on le0 proto udp all 14