En webserver og epostserver på innsiden

webserver = "192.168.2.7"
webporter = "{ http, https }"
epostserver = "192.168.2.5"
epost = "{ smtp, pop3, imap, imap3, imaps, pop3s }"

rdr on $ytre proto tcp from any to $ytre port $webporter -> $webserver
rdr on $ytre proto tcp from any to $ytre port $epost -> $epostserver

pass proto tcp from any to $webserver port $webporter \
   flags S/SA synproxy state
pass proto tcp from any to $epostserver port $epost \
   flags S/SA synproxy state
pass proto tcp from $epostserver to any port smtp \
   flags S/SA synproxy state

fungerer med eller uten separat dmz