pf

default pf.conf (from openbsd 7.3)

#       $OpenBSD: pf.conf,v 1.55 2017/12/03 20:40:04 sthen Exp $
#
# See pf.conf(5) and /etc/examples/pf.conf

table <sshbastion> { 46.23.90.11 }

set skip on lo

block return    # block stateless traffic
pass            # establish keep-state

# By default, do not permit remote connections to X11
block return in on ! lo0 proto tcp to port 6000:6010

# Port build user does not need network
block return out log proto {tcp udp} user _pbuild

block return in proto tcp to port 22
pass in quick proto tcp from <sshbastion> to port 22

block ssh except for bastion

...[output omitted]...

table <sshbastion> { <ip_address> }

...[output omitted]...

block return in proto tcp to port 22
pass in quick proto tcp from <sshbastion> to port 22