set require-order yes

scrub in all

table <spamd> persist

table <spamd-white> persist

rdr pass inet proto tcp from <spamd> to any port smtp -> 127.0.0.1 port 8025

rdr pass inet proto tcp from !<spamd-white> to any port smtp -> 127.0.0.1 port 8025

block in log all

pass out proto { tcp, udp, icmp } all keep state

pass in on lo0 all

pass out on lo0 all

pass in inet proto icmp all icmp-type echoreq keep state

pass in on $ext_if proto tcp from any to $ext_if port $allowed_tcps flags S/SA keep state

pass in on $ext_if proto udp from any to $ext_if port $allowed_udps keep state

pass in on $ext_if proto tcp from $insecure_tcp_hosts to $ext_if port $insecure_tcps flags S/SA keep state

pass in on $ext_if proto tcp from any to any port > 49151 keep state