###############
# PF Firewall #
###############

# By Default this firewall will allow any connection
# you make to come back.

ext_if = "re0" # Ethernet
int_if = "lo0" # Loopback
localhost = "127.0.0.1" # local IP

# Services to open
tcp_services_in_outside = "{22}" # Listening Ports
tcp_services_in_inside = "{x11}" # Inside Ports

# In and Out
udp_services = "{domain}" # Nameserver
#udp_services_inside = "{}"

# Allow Hosts
#allow_hosts = "{}"

# Sets
set skip on $int_if # Do not check Loopback

# Protection
scrub in all fragment reassemble  # Remove bad packets
scrub out all random-id           # Randomize Packets
antispoof quick for $ext_if       # No Spoofing

# Tables
table <bruteforce> persist # Block SSH bruteforcing

# Table Settings
block in log quick from <bruteforce> label "general-bruteforce"

# Default Block
block log (to pflog0) all # Block everything and Report to pflog0

# Block nmap
block in log quick proto tcp flags FUP/WEUAPRSF
block in log quick proto tcp flags WEUAPRSF/WEUAPRSF
block in log quick proto tcp flags SRAFU/WEUAPRSF
block in log quick proto tcp flags /WEUAPRSF
block in log quick proto tcp flags SR/SR
block in log quick proto tcp flags SF/SF

# TCP
pass in proto tcp to any port $tcp_services_in_outside

# UDP
pass in proto udp to any port $udp_services

# Pass in SSH
#pass in log proto tcp from $allow_hosts to any port ssh synproxy state \
#  (max-src-conn 15, max-src-conn-rate 10/5, \
#    overload <bruteforce> flush global)

# All out Default
#pass out proto {udp, tcp} from $tcp_unprivileges modulate state (if-bound)
pass out all