#!/bin/sh
# based on an ezunix script of the same name
# block nasties
block in log quick from any to any with ipopts
block in log quick proto tcp all with short #frags?
block in log quick on ep0 all with opt lsrr
block in log quick on ep0 all with opt ssrr
# confuse remote OS identification in case a port's listening
# block return-rst in log quick on ep0 proto tcp all flags FUP
# block return-rst in log quick on ep0 proto tcp all flags FSRPAU
# block incoming by default
#block in all
pass in all
# but allow outgoing!
pass out quick all keep state #! this should also allow all incoming replies
# allow some access to port 22
pass in quick on ep0 proto tcp from any to 192.168.0.3 port = 22
# Make extra-double-sure that ssh is blocked from the outside
block in quick on ep0 proto tcp from any to any port = 22
# allow loopback
pass in quick on lo0 all
#pass out quick on lo0 all
# block web access from a specific ip
#block in quick proto tcp from 192.168.0.254 to any port = 80
# allow all other lan communications
pass in quick on rl0 all
#pass out quick on $LAN_IF all
# deal with obvious bogus ip addresses here
# allow -some- icmp
# todo: improve this to only allow this ip, not broadcast
pass in quick on ep0 proto icmp from any to any icmp-type 0 #ping
pass in quick on ep0 proto icmp from any to any icmp-type 11 #traceroute
block in log quick on ep0 proto icmp from any to any
# allow incoming packets for services
#pass in quick proto tcp from any to any port = 8811 keep state
pass in quick proto tcp from any to any port = 993 keep state
pass in quick proto tcp from any to any port = 3791 keep state
# bittorrent 6950?!
pass in quick proto tcp from any to any port = 6950 keep state
pass in quick proto tcp from any to any port = 6882 keep state
pass in quick proto tcp from any to any port = 30050 keep state
# meta
pass in quick proto udp from any to any port = 57087 keep state
pass in quick proto udp from any to any port = 9876 keep state
pass in quick proto udp from any to any port = 5009 keep state
# remote access to my postgres db...
pass in quick proto tcp from any to any port = 2345 keep state