De las secciones anteriores resultaría un archivo /etc/pf.conf (adaptado de la Guía de PF) como el siguiente:

# Recordar poner net.inet.ip.forwarding=1 and/or net.inet6.ip6.forwarding=1
# en /etc/sysctl.conf 

ext_if="dc1"  # Cambiar por interfaz externa
int_if="dc0"  # Cambiar por interfaz interna

int_ip="192.168.1.1"  # Cambiar por dirección en LAN
ext_ip="200.93.171.42"  # Cambiar por IP pública

# LAN. Segmento de red
lan="192.168.1/24"  

# Servicios que presta cortafuegos
servicios_tcp="{ssh,domain}" 
servicios_udp="{domain}" 
servicios_icmp="echoreq"

# Servidor interno
serv_ip="192.168.2.2"
servicios_serv="{ldap,smtp,www,https,imaps}"


set block-policy return
set loginterface $ext_if

set skip on {lo enc0}
scrub in all

match out on $ext_if from !($ext_if) nat-to ($ext_if:0)

block in log all 
pass out keep state
pass quick on { lo }
antispoof quick for { lo $int_if }

pass in on $int_if proto tcp from $lan to any port ftp
pass out proto tcp from $ext_ip to any port 21

match in on $int_if proto tcp from $lan to any port ftp rdr-to \
	127.0.0.1 port 8021

pass in quick on $int_if

match in on $ext_if proto tcp from any to any port 80 rdr-to \
	$serv_ip port 80
match in on $ext_if proto tcp from any to any port 443 rdr-to \
	$serv_ip port 443
match in on $ext_if proto tcp from any to any port 993 rdr-to \
	$serv_ip port 993
match in on $ext_if proto tcp from any to any port smtp rdr-to \
	$serv_ip port smtp
match in on $ext_if proto tcp from any to any port 389 rdr-to \
	$serv_ip port 389 

match in on $ext_if proto tcp from any to any port 10022 rdr-to \
	$serv_ip port 22
pass on $ext_if proto tcp from any to any port 10022 

match in on $ext_if proto tcp from any to any port 10465 rdr-to \
	$serv_ip port 465
pass on $ext_if proto tcp from any to any port 10465 


pass in on $ext_if inet proto tcp from any to ($ext_if) \
	port $servicios_tcp keep state
pass in on $ext_if inet proto udp from any to ($ext_if) \
	port $servicios_udp keep state
pass in inet proto icmp all icmp-type $servicios_icmp keep state

pass in on $ext_if proto tcp from any to $serv_ip port $servicios_serv \
	flags S/SA synproxy state