The easy way out: The buck stops here

pass inet proto icmp icmp-type $icmp_types from $int_if:network \
          to any keep state
pass inet proto icmp icmp-type $icmp_types from any to $ext_if \
          keep state

Lets your traffic pass; hides the details of your local net