pf.conf to block *only* a specific IP address when VPN is not connected
Each packet is evaluated against the filter ruleset from top to bottom and the last matching rule wins. The quick keyword is the only exception: the packet will be blocked or passed immediately unperturbed by any later rule.

Assuming you are using the deny all approach you have to explicitly allow packets to pass in or out.

Rule set:

block all
...


To meet your "web based resource" requirement you have to quick allow/deny packets depending on the interface:

pass out quick on $vpn_ifs from any to { &lt;web_res1&gt;, &lt;web_res2&gt; } no state  
block out quick on $hw_ifs from any to { &lt;web_res1&gt;, &lt;web_res2&gt; } no state


To meet your "http and https traffic" requirement you have to allow outgoing traffic to port 80/443:

pass out on $hw_ifs from any to any port { 80, 443 }


Using the deny all approach you have add some more rules (e.g. to allow traffic from/to local networks).

The final rule set looks like this then:

block all
...
rules
...
pass out quick on $vpn_ifs from any to { &lt;web_res1&gt;, &lt;web_res2&gt; } no state  
block out quick on $hw_ifs from any to { &lt;web_res1&gt;, &lt;web_res2&gt; } no state
...
pass out on $hw_ifs from any to any port { 80, 443 }
...
more rules




Here is an example of a deny all pf.conf with a lot of rules explained. The rules are used on a FreeBSD Gateway though: some mustn't be applied or aren't useful in your environment. Single rules don't work at all (e.g. ALTQ related features).