Stuff

iface="fxp0"

#scrub in  on $iface all
#scrub out on $iface random-id
#scrub on $iface reassemble tcp

table <abusive_hosts> persist


#failsafe firewall rules.
#        pass in quick inet proto tcp from cp26621-a.gelen1.lb.home.nl to any
#        pass out quick inet proto tcp from any to cp26621-a.gelen1.lb.home.nl
#        pass in quick inet proto tcp from 193.227.121.0/24 to any
#        pass out quick inet proto tcp from any to 193.227.121.0/24

#<STANDARD>

        block in quick from <abusive_hosts>

        # annoy scanners and other malicious stuff
#        block in log quick on $iface proto tcp from any to any flags SAFRU/SAFRU
#        block in log quick on $iface proto tcp from any to any flags SF/SF
#        block in log quick on $iface proto tcp from any to any flags SR/SR
#        block in log quick inet proto tcp from any to any flags FUP/FUP
#        block in log quick inet proto tcp from any to any flags SF/SFRA
#        block in log quick inet proto tcp from any to any flags /SFRA

        # return icmp for ident and traceroute ...
        block return in quick on $iface inet proto tcp from any to any port 113
        block return in quick inet proto udp from any to any port { 33453, 33454, 33455 }

        # allow incoming ICMP_ECHOREPLY(0), ICMP_UNREACH(3) and ICMP_ECHO(8)
        pass in quick inet proto icmp all icmp-type { 0,3,8 }
        pass out quick inet proto icmp all icmp-type 8

#       block return in quick inet proto tcp from { 210.0.0.0/8 211.0.0.0/8 } to any port { 22 }

        # dont log worms
        block in quick proto { tcp,udp } from any to any port { 134><140,445,1025,3127,2745 }

#</STANDARD>

#allow SSH
        pass in log quick on $iface proto tcp from any to any port ssh flags S/SA keep state (max-src-conn 10, max-src-conn-rate 4/60, overload <abusive_hos$

# allow services
        pass in quick on $iface inet proto tcp from any to ($iface) port { 21, 53, 80, 110, 143, 6667, 55000><55500} keep state
        pass in quick on $iface inet proto tcp from any to ($iface) port { 443, 993 } flags S/SA keep state
        pass in quick proto udp from any to any port { 53 }

# allow all outgoing services
        pass out quick on $iface inet all keep state

        # block everything incoming from the internet  >:)
        block in log on $iface from any to any