set skip on lo
set block-policy drop
set optimization conservative
set state-policy if-bound
set ruleset-optimization basic

wanint="vtnet0"

# WireGuard Configuration
wg_ifs  = "{ wg0, wg1 }"
wg_net = "10.1.0.0/24"
wg_ports="{51820}"
table <wg_clients> const { 10.1.0.2, 10.1.0.4, 10.1.0.22 }

#### -- Scrub Rules -- ####
scrub in on $wanint all random-id max-mss 1360
scrub out on $wanint all random-id max-mss 1360
scrub in all
scrub out all

#### -- NAT Rules -- ####
# WireGuard Clients NAT
nat on $wanint inet from <wg_clients> to any -> ($wanint)

block all

#### -- Fail2Ban Rules -- ####
anchor "f2b/*"

pass out quick keep state

#### -- UDP Rules -- ####
pass in quick on $wg_ifs from $wg_net to any keep state
pass in quick on $wanint proto udp from any to ($wanint) port $wg_ports keep state

# HTTP/3 Protocol
pass in quick on $wanint proto udp to ($wanint) port 443 keep state

#### -- TCP Rules -- ####
# Mail Protocols
pass in quick proto tcp from any to ($wanint) port {25, 465, 587, 993, 995} synproxy state

# HTTP
pass in quick on $wanint proto tcp to ($wanint) port {80, 443} modulate state