# By C00L3R , Tony Baiacú
# Usava esta config no meu servidor
# Macro da interface de rede usada pelo Packet Filter
# ifconfig para ver a interface a ser usada pelo PF
placa = "bge0"
remote = "192.168.0.117"
remote2 = "192.168.0.154"

set optimization normal
set require-order yes
# Engana ataques fingerprint. Muito bom
# Mande um scan com nmap para ver
# nmap -O ip_do_server
set fingerprints "/etc/pf.os"
# Analise o arquivo "pf.os" para entender
set skip on lo0

# Quebra pacotes mal formados
scrub all reassemble tcp
scrub out all no-df max-mss 1492 random-id
antispoof for $placa inet

# block scans com nmap
block in quick proto tcp flags FUP/WEUAPRSF
block in quick proto tcp flags WEUAPRSF/WEUAPRSF
block in quick proto tcp flags SRAFU/WEUAPRSF
block in quick proto tcp flags /WEUAPRSF
block in quick proto tcp flags SR/SR
block in quick proto tcp flags SF/SF
block drop in quick on $placa from any os { NMAP }

# Bloqueia tudo
block all
# Libera porta SSH só para uma máquina da rede e a porta do MySQL
pass in log quick on $placa inet proto tcp from $remote to any port 22 flags S/SA
pass in log quick on $placa inet proto tcp from $remote to any port 60477 flags S/SA
pass in log quick on $placa inet proto tcp from $remote to any port 3306 flags S/SA
pass in log quick on $placa inet proto tcp from $remote2 to any port 60477 flags S/SA
# Libera HTTP para IP de dentro e de fora da rede
pass in quick on $placa inet proto tcp to $placa port { http } flags S/SA keep state
pass in quick on $placa inet proto tcp to $placa port { domain } flags S/SA keep state