1# $FreeBSD$ 2# 3# log all inbound packet on le0 which has IP options present 4# 5log in on le0 from any to any with ipopts 6# 7# block any inbound packets on le0 which are fragmented and "too short" to 8# do any meaningful comparison on. This actually only applies to TCP 9# packets which can be missing the flags/ports (depending on which part 10# of the fragment you see). 11# 12block in log quick on le0 from any to any with short frag 13# 14# log all inbound TCP packets with the SYN flag (only) set 15# (NOTE: if it were an inbound TCP packet with the SYN flag set and it 16# had IP options present, this rule and the above would cause it 17# to be logged twice). 18# 19log in on le0 proto tcp from any to any flags S/SA 20# 21# block and log any inbound ICMP unreachables 22# 23block in log on le0 proto icmp from any to any icmp-type unreach 24# 25# block and log any inbound UDP packets on le0 which are going to port 2049 26# (the NFS port). 27# 28block in log on le0 proto udp from any to any port = 2049 29# 30# quickly allow any packets to/from a particular pair of hosts 31# 32pass in quick from any to 10.1.3.2/32 33pass in quick from any to 10.1.0.13/32 34pass in quick from 10.1.3.2/32 to any 35pass in quick from 10.1.0.13/32 to any 36# 37# block (and stop matching) any packet with IP options present. 38# 39block in quick on le0 from any to any with ipopts 40# 41# allow any packet through 42# 43pass in from any to any 44# 45# block any inbound UDP packets destined for these subnets. 46# 47block in on le0 proto udp from any to 10.1.3.0/24 48block in on le0 proto udp from any to 10.1.1.0/24 49block in on le0 proto udp from any to 10.1.2.0/24 50# 51# block any inbound TCP packets with only the SYN flag set that are 52# destined for these subnets. 53# 54block in on le0 proto tcp from any to 10.1.3.0/24 flags S/SA 55block in on le0 proto tcp from any to 10.1.2.0/24 flags S/SA 56block in on le0 proto tcp from any to 10.1.1.0/24 flags S/SA 57# 58# block any inbound ICMP packets destined for these subnets. 59# 60block in on le0 proto icmp from any to 10.1.3.0/24 61block in on le0 proto icmp from any to 10.1.1.0/24 62block in on le0 proto icmp from any to 10.1.2.0/24 63