#	$OpenBSD: pf.conf,v 1.55 2017/12/03 20:40:04 sthen Exp $
#
# See pf.conf(5) and /etc/examples/pf.conf

net_if="localnet"
vps="xxx.xx.xxx.xxx"
home_net="xxx.xxx.x.x/xx"
router="xxx.xxx.x.x"

set skip on lo
block all

# Block all outgoing traffic to local network 
block out on $net_if to $home_net

# Allow outbound to router for DNS
pass out on $net_if proto { tcp, udp } to $router port domain

# Allow outbound SSH to VPS 
pass out on $net_if inet proto tcp from ($net_if) to $vps port ssh

# Allow NTP and HTTPS outbound to the internet; exclude local network
pass out on $net_if proto udp to ! $home_net port ntp
pass out on $net_if proto tcp to ! $home_net port https

# Allow inbound SSH from local network management hosts
pass in on $net_if inet proto tcp from $home_net to ($net_if) port ssh