tcpstate

# 
# Only allow TCP packets in/out of lan0 if there is an outgoing
# connection setup somewhere, waiting for it. 
# 
pass out quick on lan0 proto tcp from any to any flags S/SAFR keep state 
block out on lan0 proto tcp all 
block in on lan0 proto tcp all 
# 
# allow nameserver queries and replies to pass through, but no # other UDP 
# 
pass out quick on lan0 proto udp from any to any port = 53 
keep state 
block out on lan0 proto udp all 
block in on lan0 proto udp all