# Change the value to reflect your public interface. You can see this with ifconfig.
ext_if="re0"
# Ports used for services
service_ports="{ 22, 80 }"
# Ports used by system
system_ports="{ 11152, 13050, 13051, 13052, 13053, 13054, 17050, 17051, 17052, 17053, 17054, 13098 }"
# IP addresses that should override the firewall rules, such as your web server.
table <trusted_hosts> const { X.X.X.X, Y.Y.Y.Y }
table <abusive_hosts> persist
set block-policy drop
set loginterface $ext_if
set skip on lo
scrub on $ext_if reassemble tcp no-df random-id
antispoof quick for { lo0 $ext_if }
block in
pass out all keep state
pass out on $ext_if all modulate state
pass in quick from <trusted_hosts>
block in quick from <abusive_hosts>
# Allow ping in
pass in inet proto icmp all icmp-type echoreq
# Rate limits, trial and error
pass in on $ext_if proto tcp to any port $service_ports flags S/SA keep state \
(max-src-conn 30, max-src-conn-rate 15/5, overload <abusive_hosts> flush)
pass in on $ext_if proto {tcp,udp} to any port $system_ports flags S/SA keep state \
(max-src-conn 30, max-src-conn-rate 15/5, overload <abusive_hosts> flush)
To completely block UDP on the firewall change this line:
?
pass in on $ext_if proto {tcp,udp} to any port $system_ports flags S/SA keep state \
to
?
pass in on $ext_if proto tcp to any port $system_ports flags S/SA keep state \
