| # |
| # log all inbound packet on le0 which has IP options present |
| # |
| log in on le0 from any to any with ipopts |
| # |
| # block any inbound packets on le0 which are fragmented and "too short" to |
| # do any meaningful comparison on. This actually only applies to TCP |
| # packets which can be missing the flags/ports (depending on which part |
| # of the fragment you see). |
| # |
| block in log quick on le0 from any to any with short frag |
| # |
| # log all inbound TCP packets with the SYN flag (only) set |
| # (NOTE: if it were an inbound TCP packet with the SYN flag set and it |
| # had IP options present, this rule and the above would cause it |
| # to be logged twice). |
| # |
| log in on le0 proto tcp from any to any flags S/SA |
| # |
| # block and log any inbound ICMP unreachables |
| # |
| block in log on le0 proto icmp from any to any icmp-type unreach |
| # |
| # block and log any inbound UDP packets on le0 which are going to port 2049 |
| # (the NFS port). |
| # |
| block in log on le0 proto udp from any to any port = 2049 |
| # |
| # quickly allow any packets to/from a particular pair of hosts |
| # |
| pass in quick from any to 10.1.3.2/32 |
| pass in quick from any to 10.1.0.13/32 |
| pass in quick from 10.1.3.2/32 to any |
| pass in quick from 10.1.0.13/32 to any |
| # |
| # block (and stop matching) any packet with IP options present. |
| # |
| block in quick on le0 from any to any with ipopts |
| # |
| # allow any packet through |
| # |
| pass in from any to any |
| # |
| # block any inbound UDP packets destined for these subnets. |
| # |
| block in on le0 proto udp from any to 10.1.3.0/24 |
| block in on le0 proto udp from any to 10.1.1.0/24 |
| block in on le0 proto udp from any to 10.1.2.0/24 |
| # |
| # block any inbound TCP packets with only the SYN flag set that are |
| # destined for these subnets. |
| # |
| block in on le0 proto tcp from any to 10.1.3.0/24 flags S/SA |
| block in on le0 proto tcp from any to 10.1.2.0/24 flags S/SA |
| block in on le0 proto tcp from any to 10.1.1.0/24 flags S/SA |
| # |
| # block any inbound ICMP packets destined for these subnets. |
| # |
| block in on le0 proto icmp from any to 10.1.3.0/24 |
| block in on le0 proto icmp from any to 10.1.1.0/24 |
| block in on le0 proto icmp from any to 10.1.2.0/24 |