Configure NPF Firewall on NetBSD 10

/etc/rc.conf

npf=YES
npf_conf=/etc/npf.conf

/etc/npf.conf

$ext_if = inet4 addr "wm0"
alg "icmp"
group default {
    pass stateful on lo0 all
    pass stateful all
    pass stateful in final on wm0 proto tcp to $ext_if port 22
    pass stateful in final on wm0 proto tcp to $ext_if port 80
    pass stateful in final on wm0 proto tcp to $ext_if port 443
    pass stateful in final on wm0 proto icmp all
    block in final on wm0 all
}

Apply

npfctl reload && npfctl start
npfctl show