Openbsd Bridge question

Dear www,

  I'm trying to setup a transparent bridge between my upstream
  provider, who provides our colo and routes our ip's to our
  Webservers. I'm using openbsd 3.9. The hardware is a 1u P4 2.4 with
  1.5G ram, 2 10/100/1000 nics for the bridge and 1 10/100 for admin.

  I've been poring over any available docs out there, but they seem a
  bit dated concerning whether or not to allow forwarding to be turned
  on between the bridged nics. We have multiple subnets and there are
  times when one machine has to go out to the router and come back
  into the colo.

  My goal with the bridge is to filter all traffic coming in from the
  outside world, while allowing servers my servers behind the bridge
  to connect freely even if their traffic has to travel out to the
  router and back(keep state?).

  My point of confusion is whether or not to turn on forwarding.

  Here is my current ruleset that I plan to test over the weekend:

# cat /etc/pf.conf.future
admin_if = "fxp0"
ghost0_if = "em0" # External Interface
ghost1_if = "em1" # Internal Interface


# Create tables for groups of IP's and such.
table <NoRouteIPs> const { 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8, 127.0.0.0/8 }


# Create port access macros.
allowed_ports = "21 22 25 80 110 143 443 993 995"
cPanel_ports = "82 83 86 87 95 96 2082 2083 2086 2087 2095 2096"
special_ports = "10 26 10000"
windoze_ports = "3389"


# Normalize packets.
scrub in on $admin_if all no-df random-id
scrub in on $ghost1_if all no-df random-id


# Set up filtering rules for the admin interface.
pass in log quick on $admin_if proto tcp to port 222 modulate state
block in log quick on $admin_if from <NoRouteIPs>
block log quick on $admin_if all
pass out on $admin_if proto tcp all modulate state
pass out on $admin_if proto { udp, icmp } all keep state


# Allow traffic to flow freely through the ghost0 bridge interface.
pass in quick on $ghost0_if all
pass out quick on $ghost0_if all


# ghost1_if will be used for filtration purposes.
block in quick on $ghost1_if from <NoRouteIPs>
pass in quick on $ghost1_if proto tcp to port { $allowed_ports $cPanel_ports $special_ports $windoze_ports } modulate state
pass in quick on $ghost1_if proto tcp to port 30000:33333 modulate state
pass in quick log on $ghost1_if proto tcp to port 53 modulate state
pass in quick log on $ghost1_if proto udp to port 53 keep state
pass in quick on $ghost1_if inet proto icmp all icmp-type 0 code 0 keep state
pass in quick on $ghost1_if inet proto icmp all icmp-type 8 code 0 keep state
pass in quick on $ghost1_if inet proto icmp all icmp-type 30 code 0 keep state
block in on $ghost1_if all
pass out on $ghost1_if proto { tcp } modulate state
pass out on $ghost1_if proto { icmp, udp } keep state


Any help would be greatly appreciated.

-- 
Best regards,

Orlando L. Castro (TVCNet Engineering)