185213Sdarrenr# $FreeBSD$ 285213Sdarrenr# 385213Sdarrenr# log all inbound packet on le0 which has IP options present 485213Sdarrenr# 585213Sdarrenrlog in on le0 from any to any with ipopts 685213Sdarrenr# 785213Sdarrenr# block any inbound packets on le0 which are fragmented and "too short" to 885213Sdarrenr# do any meaningful comparison on. This actually only applies to TCP 985213Sdarrenr# packets which can be missing the flags/ports (depending on which part 1085213Sdarrenr# of the fragment you see). 1185213Sdarrenr# 1285213Sdarrenrblock in log quick on le0 from any to any with short frag 1385213Sdarrenr# 1485213Sdarrenr# log all inbound TCP packets with the SYN flag (only) set 1585213Sdarrenr# (NOTE: if it were an inbound TCP packet with the SYN flag set and it 1685213Sdarrenr# had IP options present, this rule and the above would cause it 1785213Sdarrenr# to be logged twice). 1885213Sdarrenr# 1985213Sdarrenrlog in on le0 proto tcp from any to any flags S/SA 2085213Sdarrenr# 2185213Sdarrenr# block and log any inbound ICMP unreachables 2285213Sdarrenr# 2385213Sdarrenrblock in log on le0 proto icmp from any to any icmp-type unreach 2485213Sdarrenr# 2585213Sdarrenr# block and log any inbound UDP packets on le0 which are going to port 2049 2685213Sdarrenr# (the NFS port). 2785213Sdarrenr# 2885213Sdarrenrblock in log on le0 proto udp from any to any port = 2049 2985213Sdarrenr# 3085213Sdarrenr# quickly allow any packets to/from a particular pair of hosts 3185213Sdarrenr# 3285213Sdarrenrpass in quick from any to 10.1.3.2/32 3385213Sdarrenrpass in quick from any to 10.1.0.13/32 3485213Sdarrenrpass in quick from 10.1.3.2/32 to any 3585213Sdarrenrpass in quick from 10.1.0.13/32 to any 3685213Sdarrenr# 3785213Sdarrenr# block (and stop matching) any packet with IP options present. 3885213Sdarrenr# 3985213Sdarrenrblock in quick on le0 from any to any with ipopts 4085213Sdarrenr# 4185213Sdarrenr# allow any packet through 4285213Sdarrenr# 4385213Sdarrenrpass in from any to any 4485213Sdarrenr# 4585213Sdarrenr# block any inbound UDP packets destined for these subnets. 4685213Sdarrenr# 4785213Sdarrenrblock in on le0 proto udp from any to 10.1.3.0/24 4885213Sdarrenrblock in on le0 proto udp from any to 10.1.1.0/24 4985213Sdarrenrblock in on le0 proto udp from any to 10.1.2.0/24 5085213Sdarrenr# 5185213Sdarrenr# block any inbound TCP packets with only the SYN flag set that are 5285213Sdarrenr# destined for these subnets. 5385213Sdarrenr# 5485213Sdarrenrblock in on le0 proto tcp from any to 10.1.3.0/24 flags S/SA 5585213Sdarrenrblock in on le0 proto tcp from any to 10.1.2.0/24 flags S/SA 5685213Sdarrenrblock in on le0 proto tcp from any to 10.1.1.0/24 flags S/SA 5785213Sdarrenr# 5885213Sdarrenr# block any inbound ICMP packets destined for these subnets. 5985213Sdarrenr# 6085213Sdarrenrblock in on le0 proto icmp from any to 10.1.3.0/24 6185213Sdarrenrblock in on le0 proto icmp from any to 10.1.1.0/24 6285213Sdarrenrblock in on le0 proto icmp from any to 10.1.2.0/24 63