Same problem, easy solution:
My hostname.pppoe0:
inet 0.0.0.0 255.255.255.255 NONE pppoedev rl0 authproto chap authname
'MYLOGIN' authkey 'MYPASS' up
dest 0.0.0.1
!/sbin/route delete default
!/sbin/route add default 0.0.0.1
<<<
Snip from pf.conf:
inet_if="pppoe0"
ext_if="rl0"
scrub in on pppoe0 max-mss 1400 fragment reassemble
scrub out on pppoe0 max-mss 1400 no-df random-id fragment reassemble
nat on $inet_if from !($inet_if) -> ($inet_if:0)
pass in on $inet_if proto tcp to ($inet_if) port ssh
<<<
Details are well laid in man pages, I didn't need anything except them.
BTW: I use DynDNS (noip is in ports) for remote administration, so this
setup (with open SSH port) works OK even with dynamic IPs.
--
Best wishes,
Vadim Zhukov