Thank you for the quick response.....below is
cat /etc/rc.conf
rc_startmsgs=no
clear_tmp_enable=yes
syslogd_flags="-ss"
sendmail_enable=none
sendmail_submit_enable=no
sendmail_outbound_enable=no
sendmail_msp_que_enable=no
keyrate="250.34"
zfs_enable=yes
zfskeys_enable=yes
autofs_enable=yes
dumpdev=no
microcode_update_enable=yes
smartd_enable=yes
kld_list="i915kms cuse coretemp fusefs ng_ether ng_eiface ng_bridge nmdm nvidia vmm"
nvidia_xorg_enable=yes
WITHOUT_DRM_MODULE=t
WITHOUT_DRM2_MODULE=t
openntpd_enable=yes
openntpd_flags=-v
moused_enable=yes
moused_flags="-V -A 1.5 -t intellimouse"
powerd_enable=yes
powerd_flags="-a hiadaptive -b adaptive"
performance_cx_lowest="Cmax"
economy_cx_lowest="Cmax"
hostname="pju"
clamav_clamd_enable=yes
clamav_freshclam_enable=yes
wlans_ath0="wlan0"
ifconfig_wlan0="WPA DHCP"
ifconfig_ue0="DHCP"
background_dhclient=yes
tcp_drop_synfin=yes
#dbus_enable=yes
devfs_system_ruleset="devfsrules_common"
wireguard_enable="yes"
wireguard_interfaces="wg0"
tor_enable=yes
virtual_oss_enable=yes
virtual_oss_configs="dsp dummy"
virtual_oss_dsp="-T /dev/sndstat -S -i 8 -C 18 -c 18 -r 48000 -b 32 -s 768 -f /dev/dsp0 -c 2 -w dsp.wav -d dsp -t dsp.ctl"
virtual_oss_dummy="-T /dev/sndstat -S -i 8 -C 2 -c 2 -r 48000 -b 32 -s 768 -f /dev/null -c 2 -w vdsp.wav -d vdsp -t vdsp.ctl"
privoxy_enable=yes
# webcamd_enable=yes
# webcamd_0_flags="-d ugen1.6"
# PF firewall
pf_enable=yes # Enable PF (load module if required)
pf_rules=/etc/pf.conf # rules definition file for pf
pf_flags="" # additional flags for pfctl startup
pflog_enable=yes # start pflogd(8)
pflog_logfile=/var/log/pflog # where pflogd should store the logfile
pflog_flags="" # additional flags for pflogd startup
# b@TT3Ry m0n!ToR
battmond_enable=yes
battmond_flags="-W 10 -H 7"
# s3cuRe z0Ne
#kern_securelevel_enable=yes
#kern_securelevel="1"
cat /etc/pf.conf
# FreeBSD 13 pf syntax below
# Variables and Macro
#egress="wlan0"
egress="ue0"
int_if="lo"
#egress_ip="192.168.117.25"
egress_ip="192.168.103.7"
localnet = $int_if:network # For NAT purposes
minefield="1024:9999"
ssh_alternate_port=2345
netbios_tcp = "{ 22, 23, 25, 80, 110, 111, 123, 512, 513, 514, 515, 6000, 6010 }"
netbios_udp = "{ 123, 512, 513, 514, 515, 5353, 6000, 6010 }"
# Global Policy
set block-policy drop
set loginterface $egress
set skip on lo
scrub all no-df max-mss 1440 random-id reassemble tcp
scrub out on $egress proto udp from $egress_ip to any port 443 set-tos lowdelay
altq on $egress hfsc bandwidth 1950Kb queue {def_up}
altq on $int_if hfsc bandwidth 1950Kb queue {def_down}
queue def_up bandwidth 1950Kb hfsc(default)
queue def_down bandwidth 1950Kb hfsc(default)
nat on $egress from $localnet to any -> ($egress)
nat on $int_if from any to any -> ($int_if)
#nat on $egress inet proto { tcp, udp, icmp } from $jail -> ($egress)
nat on $egress from 192.168.0.0/24 -> $egress:0
#nat on $egress inet from $localnet to any -> ($egress)
#nat on $egress inet from { $localnet $debian secure } to any -> ($egress)
#nat on $egress from $jailnet to any -> $egress:0
#nat on $egress from 192.168.77.23 to any -> $egress
#rdr on $egress to $egress:0 port 22 -> ($jail_if)
#rdr on $egress proto tcp from any to $egress port 80 to any -> ($egress)
#rdr on $egress to $egress port 80 to any -> $egress
#rdr pass log on $egress $int_if inet proto udp to $egress port $secure_port -> $secure_ipv4
rdr pass on $egress inet proto tcp from any to port = 2345 -> 192.168.117.25
rdr pass on $egress inet proto tcp from any to port = 2345 -> 192.168.103.7
table <bruteforce> persist
table <bruteforce> persist file "/etc/bloked_subneTs"
block quick from <bruteforce>
block in all
#table <ftp-attacks> persist file "/etc/pf.ftp.block.list"
table <ftp-attacks> persist
table <troublemakers> persist
pass quick proto { tcp, udp } from any to any port ssh \
flags S/SA keep state \
(max-src-conn 15, max-src-conn-rate 5/3, \
overload <bruteforce> flush global)
# Default deny and log all
block log all
# Antispoof
antispoof log quick for ($egress)
block in quick log on $egress from { no-route urpf-failed } to any
block in quick on $egress from any to 255.255.255.255
block in quick log on $egress from { 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 255.255.255.255/32 } to any
block in quick on $egress from <ftp-attacks> # block all incoming connections from attackers on FTPD
### Block to and from port 0
block quick proto { tcp, udp } from any port = 0 to any
block quick proto { tcp, udp } from any to any port = 0
block quick proto tcp from <troublemakers> to (egress) port $ssh_alternate_port
block quick proto tcp from <bruteforce> to (egress) port $ssh_alternate_port
### Block specific ports
block in quick log on $egress proto tcp from any to any port $netbios_tcp
block in quick log on $egress proto udp from any to any port $netbios_udp
# IPv4 source address.
block in quick on $egress from 172.24.166.244 to any
block in quick on $egress from 34.117.59.81 to any
block in quick on $egress from 23.19.66.99 to any
block in quick on $egress from 172.16.0.1 to any
block in quick on $egress from 95.168.170.140 to any
block in quick on $egress from 95.216.33.30 to any
block in quick on $egress from 217.105.115.196 to any
# IPv4 destination address.
block in quick on $egress from 167.71.195.165 to any
block in quick on $egress from 172.24.166.244 to any
block in quick on $egress from 172.19.236.121 to any
block in quick on $egress from 172.16.0.1 to any
# Source port.
block in quick on $egress proto udp from any to any port 61398
block in quick on $egress proto tcp from any to any port 80
block in quick on $egress proto tcp from any to any port 443
block in quick on $egress proto udp from any to any port 53
block in quick on $egress proto udp from any to any port 29907
block in quick on $egress proto tcp from any to any port 45940
# Destination port.
block in quick on $egress proto udp from any to any port 123
block in quick on $egress proto tcp from any to any port 65473
block in quick on $egress proto tcp from any to any port 58779
block in quick on $egress proto udp from any to any port 33164
block in quick on $egress proto tcp from any to any port 20272
block in quick on $egress proto tcp from any to any port 59595
block in quick on $egress proto udp from any to any port 53
block in quick on $egress proto tcp from any to any port 52828
block in quick on $egress proto tcp from any to any port 17674
block in quick on $egress proto tcp from any to any port 27933
# IPv4 source address and port.
block in quick on $egress proto udp from 172.24.166.244 to any port 61398
block in quick on $egress proto tcp from 34.117.59.81 to any port 80
block in quick on $egress proto tcp from 23.19.66.99 to any port 443
block in quick on $egress proto udp from 172.16.0.1 to any port 53
block in quick on $egress proto tcp from any to any port 20272
block in quick on $egress proto tcp from 95.216.33.30 to any port 443
block in quick on $egress proto udp from 172.24.166.244 to any port 29907
block in quick on $egress proto tcp from 217.105.115.196 to any port 45940
# IPv4 destination address and port.
block in quick on $egress proto udp from 167.71.195.165 to any port 123
block in quick on $egress proto tcp from 172.24.166.244 to any port 65473
block in quick on $egress proto tcp from 172.24.166.244 to any port 58779
block in quick on $egress proto udp from 172.24.166.244 to any port 33164
block in quick on $egress proto tcp from 172.24.166.244 to any port 20272
block in quick on $egress proto tcp from 172.24.166.244 to any port 59595
block in quick on $egress proto udp from 172.16.0.1 to any port 53
block in quick on $egress proto tcp from 172.19.236.121 to any port 52828
block in quick on $egress proto tcp from 172.19.236.121 to any port 17674
# Block IPV6
block quick inet6 all
block out quick inet6 all
# Prevent VPN WIREGUARD bypass
block out quick log on $egress from ($int_if:network) to any
block out quick log on $egress from any to no-route
# Drop outbound DNS requests (53), as we use DNSCrypt
block out quick log on $egress proto { tcp udp } from any to any port 53
# dhcp clients and dhcp server
pass quick on $egress inet proto tcp from any port 67:68 to any port 67:68 keep state flags S/SA
pass quick on $egress inet proto udp from any port 67:68 to any port 67:68 keep state
pass quick on $int_if inet proto tcp from any port 67:68 to any port 67:68 keep state flags S/SA
pass quick on $int_if inet proto udp from any port 67:68 to any port 67:68 keep state
# Let us allow FTP with bruteforce protection
pass in quick on $egress inet proto tcp from any to ($egress) port 21 keep state (max-src-conn-rate 5/40, overload <ftp-attacks> flush global)
# if we're still trouble, add to the troublemakers
pass in on egress proto tcp from any to (egress) port { telnet, ssh, netbios-ns, netbios-ssn, microsoft-ds } synproxy state tag trouble
pass in on egress proto tcp from any to (egress) port $minefield synproxy state tag trouble
pass in proto tcp from any to (egress) port $ssh_alternate_port tag good
pass proto tcp from any to (egress) port $ssh_alternate_port tagged trouble synproxy state (max-src-conn 1, max-src-conn-rate 1/10, overload <troublemakers> flush global)
pass proto tcp from any to (egress) port {$ssh_alternate_port} flags S/SA keep state (max-src-conn 5, max-src-conn-rate 5/5, overload <bruteforce> flush global)
pass proto tcp from any to any port {http https} keep state (max-src-conn 10, max-src-conn-rate 10/3)
### Keep and modulate state of outbound tcp, udp and icmp traffic
pass out on $egress proto { tcp, udp, icmp } from any to any modulate state
pass out quick inet proto tcp user _tor flags S/SA modulate state
# op3nnTpd
pass out quick on $egress inet proto udp from any to any port ntp
pass out quick on $egress inet proto tcp from any to any port ntp
# jails
# Standard rules
antispoof for $egress
antispoof for $egress
pass out quick inet modulate state
pass in quick on $int_if
block quick from <bruteforce>
block in all
I got those from you guys which i then tried to modify to my taste. I don't know whether they are useful or not specially my pf.conf
