# pfctl -vvsr @0 scrub all random-id fragment reassemble [ Evaluations: 76791 Packets: 76791 Bytes: 0 States: 0 ] @0 anchor "ftpsesame/*" all [ Evaluations: 806 Packets: 0 Bytes: 0 States: 0 ] @1 anchor "firewallrules" all [ Evaluations: 806 Packets: 0 Bytes: 0 States: 0 ] @2 block drop quick from to any label "Block snort2c hosts" [ Evaluations: 806 Packets: 0 Bytes: 0 States: 0 ] @3 block drop quick from any to label "Block snort2c hosts" [ Evaluations: 806 Packets: 0 Bytes: 0 States: 0 ] @4 anchor "loopback" all [ Evaluations: 806 Packets: 0 Bytes: 0 States: 0 ] @5 pass in quick on lo0 all label "pass loopback" [ Evaluations: 806 Packets: 0 Bytes: 0 States: 0 ] @6 pass out quick on lo0 all label "pass loopback" [ Evaluations: 0 Packets: 0 Bytes: 0 States: 0 ] @7 anchor "packageearly" all [ Evaluations: 806 Packets: 0 Bytes: 0 States: 0 ] @8 anchor "carp" all [ Evaluations: 806 Packets: 0 Bytes: 0 States: 0 ] @9 anchor "dhcpserverlan" all [ Evaluations: 806 Packets: 0 Bytes: 0 States: 0 ] @10 pass in quick on xl0 inet proto udp from any port = bootpc to 255.255.255.255 port = bootps label "allow access to DHCP server on LAN" [ Evaluations: 806 Packets: 0 Bytes: 0 States: 0 ] @11 pass in quick on xl0 inet proto udp from any port = bootpc to 192.168.1.1 port = bootps label "allow access to DHCP server on LAN" [ Evaluations: 1 Packets: 1 Bytes: 328 States: 0 ] @12 pass out quick on xl0 inet proto udp from 192.168.1.1 port = bootps to any port = bootpc label "allow access to DHCP server on LAN" [ Evaluations: 48 Packets: 1 Bytes: 328 States: 0 ] @13 anchor "wandhcp" all [ Evaluations: 804 Packets: 0 Bytes: 0 States: 0 ] @14 pass out quick on ed0 proto udp from any port = bootpc to any port = bootps label "allow dhcp client out wan" [ Evaluations: 804 Packets: 0 Bytes: 0 States: 0 ] @15 block drop in log quick on ed0 inet proto udp from any port = bootps to 192.168.1.0/24 port = bootpc label "block dhcp client out wan" [ Evaluations: 32 Packets: 0 Bytes: 0 States: 0 ] @16 pass in quick on ed0 proto udp from any port = bootps to any port = bootpc label "allow dhcp client out wan" [ Evaluations: 2 Packets: 2 Bytes: 632 States: 0 ] @17 block drop in on ! xl0 inet from 192.168.1.0/24 to any [ Evaluations: 790 Packets: 0 Bytes: 0 States: 0 ] @18 block drop in inet from 192.168.1.1 to any [ Evaluations: 596 Packets: 0 Bytes: 0 States: 0 ] @19 block drop in on xl0 inet6 from fe80::204:76ff:fe9a:2a40 to any [ Evaluations: 590 Packets: 0 Bytes: 0 States: 0 ] @20 anchor "spoofing" all [ Evaluations: 802 Packets: 0 Bytes: 0 States: 0 ] @21 block drop in log quick on ed0 inet from 10.0.0.0/8 to any label "block private networks from wan block 10/8" [ Evaluations: 802 Packets: 0 Bytes: 0 States: 0 ] @22 block drop in log quick on ed0 inet from 127.0.0.0/8 to any label "block private networks from wan block 127/8" [ Evaluations: 18 Packets: 0 Bytes: 0 States: 0 ] @23 block drop in log quick on ed0 inet from 172.16.0.0/12 to any label "block private networks from wan block 172.16/12" [ Evaluations: 18 Packets: 0 Bytes: 0 States: 0 ] @24 block drop in log quick on ed0 inet from 192.168.0.0/16 to any label "block private networks from wan block 192.168/16" [ Evaluations: 18 Packets: 0 Bytes: 0 States: 0 ] @25 anchor "limitingesr" all [ Evaluations: 802 Packets: 0 Bytes: 0 States: 0 ] @26 block drop in quick from to any label "virusprot overload table" [ Evaluations: 802 Packets: 0 Bytes: 0 States: 0 ] @27 pass out quick on ed0 all keep state label "let out anything from firewall host itself" [ Evaluations: 802 Packets: 4774 Bytes: 2085442 States: 11 ] @28 anchor "firewallout" all [ Evaluations: 596 Packets: 0 Bytes: 0 States: 0 ] @29 pass out quick on ed0 all keep state label "let out anything from firewall host itself" [ Evaluations: 596 Packets: 0 Bytes: 0 States: 0 ] @30 pass out quick on xl0 all keep state label "let out anything from firewall host itself" [ Evaluations: 578 Packets: 19 Bytes: 976 States: 0 ] @31 anchor "anti-lockout" all [ Evaluations: 590 Packets: 0 Bytes: 0 States: 0 ] @32 pass in quick inet from 192.168.1.0/24 to 192.168.1.1 keep state label "anti-lockout web rule" [ Evaluations: 590 Packets: 12694 Bytes: 3220024 States: 1 ] @33 block drop in log proto tcp from to any port = ssh label "sshlockout" [ Evaluations: 184 Packets: 0 Bytes: 0 States: 0 ] @34 anchor "ftpproxy" all [ Evaluations: 184 Packets: 0 Bytes: 0 States: 0 ] @35 anchor "pftpx/*" all [ Evaluations: 184 Packets: 0 Bytes: 0 States: 0 ] @36 pass in quick on ed0 inet proto tcp from any to 192.168.1.2 port = ftp keep state label "USER_RULE: NAT zeus (FTPServer)" [ Evaluations: 184 Packets: 0 Bytes: 0 States: 0 ] @37 pass in quick on ed0 inet proto udp from any to 192.168.1.2 port = ftp keep state label "USER_RULE: NAT zeus (FTPServer)" [ Evaluations: 5 Packets: 0 Bytes: 0 States: 0 ] @38 pass in quick on ed0 inet proto tcp from any to 90.224.32.143 port = ftp keep state label "USER_RULE: NAT zeus (FTPServer)" [ Evaluations: 12 Packets: 0 Bytes: 0 States: 0 ] @39 pass in quick on ed0 inet proto udp from any to 90.224.32.143 port = ftp keep state label "USER_RULE: NAT zeus (FTPServer)" [ Evaluations: 5 Packets: 0 Bytes: 0 States: 0 ] @40 pass in log quick on ed0 inet proto tcp from any to 192.168.1.2 port = http flags S/SA keep state label "USER_RULE: NAT zeus (WebServer)" [ Evaluations: 18 Packets: 19 Bytes: 976 States: 0 ] @41 pass in quick on ed0 inet proto tcp from any to 192.168.1.2 port = ssh keep state label "USER_RULE: NAT zeus (SSHServer)" [ Evaluations: 0 Packets: 0 Bytes: 0 States: 0 ] @42 pass in quick on ed0 inet proto tcp from any to 192.168.1.3 port = 6881 keep state label "USER_RULE: NAT hades (Torrent)" [ Evaluations: 7 Packets: 0 Bytes: 0 States: 0 ] @43 pass in quick on ed0 inet proto udp from any to 192.168.1.3 port = 6881 keep state label "USER_RULE: NAT hades (Torrent)" [ Evaluations: 5 Packets: 0 Bytes: 0 States: 0 ] @44 pass in quick on xl0 inet from 192.168.1.0/24 to any keep state label "USER_RULE: Default LAN -> any" [ Evaluations: 178 Packets: 4356 Bytes: 2049587 States: 10 ] @45 pass in quick on ed0 inet proto tcp from any to 192.168.1.2 port = http keep state label "USER_RULE: NAT zeus (Webserver)" [ Evaluations: 12 Packets: 0 Bytes: 0 States: 0 ] @46 pass in quick on ed0 inet proto udp from any to 192.168.1.2 port = http keep state label "USER_RULE: NAT zeus (Webserver)" [ Evaluations: 5 Packets: 0 Bytes: 0 States: 0 ] @47 pass in quick on xl0 inet proto tcp from any to 127.0.0.1 port = ftp-proxy keep state label "FTP PROXY: Allow traffic to localhost" [ Evaluations: 12 Packets: 0 Bytes: 0 States: 0 ] @48 pass in quick on xl0 inet proto tcp from any to 127.0.0.1 port = ftp keep state label "FTP PROXY: Allow traffic to localhost" [ Evaluations: 0 Packets: 0 Bytes: 0 States: 0 ] @49 pass in quick on ed0 inet proto tcp from any port = ftp-data to (ed0:1) port > 49000 user = 62 flags S/SA keep state label "FTP PROXY: PASV mode data connection" [ Evaluations: 12 Packets: 0 Bytes: 0 States: 0 ] @50 anchor "miniupnpd" all [ Evaluations: 12 Packets: 0 Bytes: 0 States: 0 ] @51 block drop in log quick all label "Default block all just to be sure." [ Evaluations: 12 Packets: 12 Bytes: 900 States: 0 ] @52 block drop out log quick all label "Default block all just to be sure." [ Evaluations: 0 Packets: 0 Bytes: 0 States: 0 ]