Межсетевой экран шлюза на основе PF для Openbsd 6.0

В настоящее время я собираюсь создать шлюз на основе OpenBSD 6.0 pf. Основываясь на том, что я прочитал на страницах руководства pf и FAQ по OpenBSD pf, а также на некоторых примерах в Интернете, я смог настроить брандмауэр. Но я не уверен, правильно ли я понял:

## Macros
wan="WAN interface"
wan_ip="WAN IP address"
lan="LAN interface"
lan_ip="LAN IP address"
lan_nw="LAN network address with subnetmask"
man="management interface"
man_ip="management ip address"
lo="lo0"


## TABLES
table <spammers> persist file "/etc/spammers.txt"


## OPTIONS
set block-policy drop
# debug lvl: none - urgent - misc - loud
set debug none
set limit { frags 2000, states 20000, src-nodes 2000, tables 1000, table-entries 100000 }
set loginterface { $wan, $lan, $man }
set optimization normal
set reassemble yes
set ruleset-optimization none
set skip on $lo
set state-defaults pflow, no-sync
set state-policy if-bound


## TRAFFIC NORMALIZATION
scrub on $wan all reassemble tcp
scrub in on $wan all fragment reassemble max-mss 1440
scrub out on $wan all fragment reassemble random-id no-df
# For NFS
scrub in on $lan all no-df
scrub out on $lan all no-df
antispoof for { $lo, $wan, $lan, $man }


## QUEUEING RULES


## TRANSLATION RULES (NAT)
nat on $wan from $lan_nw to any -> $wan_ip

## FILTER RULES
# Block everything (inbound AND outbound on ALL interfaces) by default (catch-all)
block all
# Block everything comming from and to spam IP's
block in on $wan from <spammers> to any
block out on $wan from any to <spammers>
# Activate spoofing protection for all interfaces
block in on all from urpf-failed

# Default TCP policy
block return-rst in log on $wan proto TCP all
    pass in quick on $man proto TCP from any to $man_ip port 22 flags S/FSRA keep state

# Default UDP policy
block in log on $wan proto udp all
    # Provide NTP to LAN and mgmt network.
    pass in quick on $lan proto UDP from any to $lan_ip port 123
    pass in quick on $man proto UDP from any to $man_ip port 123

# Default ICMP policy
block in log on $wan proto icmp all
    pass in quick on $wan proto icmp from any to $wan_ip echoreq keep state

block out on $wan all
    pass out quick on $wan from $wan_ip to any keep state

Этого достаточно для создания надежного шлюза-маршрутизатора? Может ли кто-нибудь просмотреть мою конфигурацию и дать отзывы или рекомендации?