#!/bin/sh
# based on an ezunix script of the same name

# block nasties
block in log quick from any to any with ipopts
block in log quick proto tcp all with short #frags?
block in log quick on ep0 all with opt lsrr
block in log quick on ep0 all with opt ssrr

# confuse remote OS identification in case a port's listening
# block return-rst in log quick on ep0 proto tcp all flags FUP
# block return-rst in log quick on ep0 proto tcp all flags FSRPAU

# block incoming by default
#block in all
pass in all

# but allow outgoing!
pass out quick all keep state #! this should also allow all incoming replies

# allow some access to port 22
pass in quick on ep0 proto tcp from any to 192.168.0.3 port = 22




# Make extra-double-sure that ssh is blocked from the outside
block in quick on ep0 proto tcp from any to any port = 22

# allow loopback
pass in quick on lo0 all 
#pass out quick on lo0 all

# block web access from a specific ip
#block in quick proto tcp from 192.168.0.254 to any port = 80
# allow all other lan communications
pass in quick on rl0 all
#pass out quick on $LAN_IF all

# deal with obvious bogus ip addresses here

# allow -some- icmp
# todo: improve this to only allow this ip, not broadcast
pass in quick on ep0 proto icmp from any to any icmp-type 0 #ping
pass in quick on ep0 proto icmp from any to any icmp-type 11 #traceroute
block in log quick on ep0 proto icmp from any to any

# allow incoming packets for services
#pass in quick proto tcp from any to any port = 8811 keep state
pass in quick proto tcp from any to any port = 993 keep state
pass in quick proto tcp from any to any port = 3791 keep state

# bittorrent 6950?!
pass in quick proto tcp from any to any port = 6950 keep state
pass in quick proto tcp from any to any port = 6882 keep state
pass in quick proto tcp from any to any port = 30050 keep state

# meta
pass in quick proto udp from any to any port = 57087 keep state 
pass in quick proto udp from any to any port = 9876 keep state
pass in quick proto udp from any to any port = 5009 keep state

# remote access to my postgres db... 
pass in quick proto tcp from any to any port = 2345 keep state