# pfctl -vvsr
@0 scrub all random-id fragment reassemble
[ Evaluations: 76791 Packets: 76791 Bytes: 0 States: 0 ]
@0 anchor "ftpsesame/*" all
[ Evaluations: 806 Packets: 0 Bytes: 0 States: 0 ]
@1 anchor "firewallrules" all
[ Evaluations: 806 Packets: 0 Bytes: 0 States: 0 ]
@2 block drop quick from <snort2c:0> to any label "Block snort2c hosts"
[ Evaluations: 806 Packets: 0 Bytes: 0 States: 0 ]
@3 block drop quick from any to <snort2c:0> label "Block snort2c hosts"
[ Evaluations: 806 Packets: 0 Bytes: 0 States: 0 ]
@4 anchor "loopback" all
[ Evaluations: 806 Packets: 0 Bytes: 0 States: 0 ]
@5 pass in quick on lo0 all label "pass loopback"
[ Evaluations: 806 Packets: 0 Bytes: 0 States: 0 ]
@6 pass out quick on lo0 all label "pass loopback"
[ Evaluations: 0 Packets: 0 Bytes: 0 States: 0 ]
@7 anchor "packageearly" all
[ Evaluations: 806 Packets: 0 Bytes: 0 States: 0 ]
@8 anchor "carp" all
[ Evaluations: 806 Packets: 0 Bytes: 0 States: 0 ]
@9 anchor "dhcpserverlan" all
[ Evaluations: 806 Packets: 0 Bytes: 0 States: 0 ]
@10 pass in quick on xl0 inet proto udp from any port = bootpc to 255.255.255.255 port = bootps label "allow access to DHCP server on LAN"
[ Evaluations: 806 Packets: 0 Bytes: 0 States: 0 ]
@11 pass in quick on xl0 inet proto udp from any port = bootpc to 192.168.1.1 port = bootps label "allow access to DHCP server on LAN"
[ Evaluations: 1 Packets: 1 Bytes: 328 States: 0 ]
@12 pass out quick on xl0 inet proto udp from 192.168.1.1 port = bootps to any port = bootpc label "allow access to DHCP server on LAN"
[ Evaluations: 48 Packets: 1 Bytes: 328 States: 0 ]
@13 anchor "wandhcp" all
[ Evaluations: 804 Packets: 0 Bytes: 0 States: 0 ]
@14 pass out quick on ed0 proto udp from any port = bootpc to any port = bootps label "allow dhcp client out wan"
[ Evaluations: 804 Packets: 0 Bytes: 0 States: 0 ]
@15 block drop in log quick on ed0 inet proto udp from any port = bootps to 192.168.1.0/24 port = bootpc label "block dhcp client out wan"
[ Evaluations: 32 Packets: 0 Bytes: 0 States: 0 ]
@16 pass in quick on ed0 proto udp from any port = bootps to any port = bootpc label "allow dhcp client out wan"
[ Evaluations: 2 Packets: 2 Bytes: 632 States: 0 ]
@17 block drop in on ! xl0 inet from 192.168.1.0/24 to any
[ Evaluations: 790 Packets: 0 Bytes: 0 States: 0 ]
@18 block drop in inet from 192.168.1.1 to any
[ Evaluations: 596 Packets: 0 Bytes: 0 States: 0 ]
@19 block drop in on xl0 inet6 from fe80::204:76ff:fe9a:2a40 to any
[ Evaluations: 590 Packets: 0 Bytes: 0 States: 0 ]
@20 anchor "spoofing" all
[ Evaluations: 802 Packets: 0 Bytes: 0 States: 0 ]
@21 block drop in log quick on ed0 inet from 10.0.0.0/8 to any label "block private networks from wan block 10/8"
[ Evaluations: 802 Packets: 0 Bytes: 0 States: 0 ]
@22 block drop in log quick on ed0 inet from 127.0.0.0/8 to any label "block private networks from wan block 127/8"
[ Evaluations: 18 Packets: 0 Bytes: 0 States: 0 ]
@23 block drop in log quick on ed0 inet from 172.16.0.0/12 to any label "block private networks from wan block 172.16/12"
[ Evaluations: 18 Packets: 0 Bytes: 0 States: 0 ]
@24 block drop in log quick on ed0 inet from 192.168.0.0/16 to any label "block private networks from wan block 192.168/16"
[ Evaluations: 18 Packets: 0 Bytes: 0 States: 0 ]
@25 anchor "limitingesr" all
[ Evaluations: 802 Packets: 0 Bytes: 0 States: 0 ]
@26 block drop in quick from <virusprot:0> to any label "virusprot overload table"
[ Evaluations: 802 Packets: 0 Bytes: 0 States: 0 ]
@27 pass out quick on ed0 all keep state label "let out anything from firewall host itself"
[ Evaluations: 802 Packets: 4774 Bytes: 2085442 States: 11 ]
@28 anchor "firewallout" all
[ Evaluations: 596 Packets: 0 Bytes: 0 States: 0 ]
@29 pass out quick on ed0 all keep state label "let out anything from firewall host itself"
[ Evaluations: 596 Packets: 0 Bytes: 0 States: 0 ]
@30 pass out quick on xl0 all keep state label "let out anything from firewall host itself"
[ Evaluations: 578 Packets: 19 Bytes: 976 States: 0 ]
@31 anchor "anti-lockout" all
[ Evaluations: 590 Packets: 0 Bytes: 0 States: 0 ]
@32 pass in quick inet from 192.168.1.0/24 to 192.168.1.1 keep state label "anti-lockout web rule"
[ Evaluations: 590 Packets: 12694 Bytes: 3220024 States: 1 ]
@33 block drop in log proto tcp from <sshlockout:0> to any port = ssh label "sshlockout"
[ Evaluations: 184 Packets: 0 Bytes: 0 States: 0 ]
@34 anchor "ftpproxy" all
[ Evaluations: 184 Packets: 0 Bytes: 0 States: 0 ]
@35 anchor "pftpx/*" all
[ Evaluations: 184 Packets: 0 Bytes: 0 States: 0 ]
@36 pass in quick on ed0 inet proto tcp from any to 192.168.1.2 port = ftp keep state label "USER_RULE: NAT zeus (FTPServer)"
[ Evaluations: 184 Packets: 0 Bytes: 0 States: 0 ]
@37 pass in quick on ed0 inet proto udp from any to 192.168.1.2 port = ftp keep state label "USER_RULE: NAT zeus (FTPServer)"
[ Evaluations: 5 Packets: 0 Bytes: 0 States: 0 ]
@38 pass in quick on ed0 inet proto tcp from any to 90.224.32.143 port = ftp keep state label "USER_RULE: NAT zeus (FTPServer)"
[ Evaluations: 12 Packets: 0 Bytes: 0 States: 0 ]
@39 pass in quick on ed0 inet proto udp from any to 90.224.32.143 port = ftp keep state label "USER_RULE: NAT zeus (FTPServer)"
[ Evaluations: 5 Packets: 0 Bytes: 0 States: 0 ]
@40 pass in log quick on ed0 inet proto tcp from any to 192.168.1.2 port = http flags S/SA keep state label "USER_RULE: NAT zeus (WebServer)"
[ Evaluations: 18 Packets: 19 Bytes: 976 States: 0 ]
@41 pass in quick on ed0 inet proto tcp from any to 192.168.1.2 port = ssh keep state label "USER_RULE: NAT zeus (SSHServer)"
[ Evaluations: 0 Packets: 0 Bytes: 0 States: 0 ]
@42 pass in quick on ed0 inet proto tcp from any to 192.168.1.3 port = 6881 keep state label "USER_RULE: NAT hades (Torrent)"
[ Evaluations: 7 Packets: 0 Bytes: 0 States: 0 ]
@43 pass in quick on ed0 inet proto udp from any to 192.168.1.3 port = 6881 keep state label "USER_RULE: NAT hades (Torrent)"
[ Evaluations: 5 Packets: 0 Bytes: 0 States: 0 ]
@44 pass in quick on xl0 inet from 192.168.1.0/24 to any keep state label "USER_RULE: Default LAN -> any"
[ Evaluations: 178 Packets: 4356 Bytes: 2049587 States: 10 ]
@45 pass in quick on ed0 inet proto tcp from any to 192.168.1.2 port = http keep state label "USER_RULE: NAT zeus (Webserver)"
[ Evaluations: 12 Packets: 0 Bytes: 0 States: 0 ]
@46 pass in quick on ed0 inet proto udp from any to 192.168.1.2 port = http keep state label "USER_RULE: NAT zeus (Webserver)"
[ Evaluations: 5 Packets: 0 Bytes: 0 States: 0 ]
@47 pass in quick on xl0 inet proto tcp from any to 127.0.0.1 port = ftp-proxy keep state label "FTP PROXY: Allow traffic to localhost"
[ Evaluations: 12 Packets: 0 Bytes: 0 States: 0 ]
@48 pass in quick on xl0 inet proto tcp from any to 127.0.0.1 port = ftp keep state label "FTP PROXY: Allow traffic to localhost"
[ Evaluations: 0 Packets: 0 Bytes: 0 States: 0 ]
@49 pass in quick on ed0 inet proto tcp from any port = ftp-data to (ed0:1) port > 49000 user = 62 flags S/SA keep state label "FTP PROXY: PASV mode data connection"
[ Evaluations: 12 Packets: 0 Bytes: 0 States: 0 ]
@50 anchor "miniupnpd" all
[ Evaluations: 12 Packets: 0 Bytes: 0 States: 0 ]
@51 block drop in log quick all label "Default block all just to be sure."
[ Evaluations: 12 Packets: 12 Bytes: 900 States: 0 ]
@52 block drop out log quick all label "Default block all just to be sure."
[ Evaluations: 0 Packets: 0 Bytes: 0 States: 0 ]