no wait, that didn't work.
I put in....
pass in quick on $ext_if inet from $ext_if:network to any keep state
and all it translated to was....
pass in quick on xl0 inet from 192.168.1.0/24 to any keep state
that doesn't allow me to connect to the net, it allows traffic from my LAN into my router.