# Enable PF Firewall
pf_enable="YES"
pf_rules_enable="YES"

#!/bin/sh
# Revision 0.9 Wed Sep 27 22:16:55 EEST 2006
#
# Copyright (c) 2006 Dominique Goncalves
# Copyright (c) 2006 Andrei Kolu
# Modified 2006 Kris Moore (PC-BSD Software)
#
# See COPYING for licence terms.
#
# Create a basic pf.conf.
# Block everything by default,
# Allow everything on lo0,
# Do not create rules on some interface ie: plip0,
# Allow all tcp and udp connections to outside with keep state flags,
# Allow icmp on all interfaces.
#
# PROVIDE: pf_rules
# REQUIRE: netif
# BEFORE: pf

. /etc/rc.subr

name="pf_rules"
rcvar=`set_rcvar`
start_cmd="create_rules"
required_files="$pf_rules"

create_rules ()
{
        echo "Creating $pf_rules."

        echo "set skip on { lo0 }" > $pf_rules
        echo "scrub in all" >> $pf_rules
        echo "block drop all" >> $pf_rules
#        echo "pass quick on all" >> $pf_rules
        echo 'table <blacklist> persist file "/etc/blacklist"'  >> $pf_rules
        echo "pass out inet proto icmp all icmp-type echoreq keep state" >> $pf_rules
        echo "pass in proto tcp from any to any port www flags S/SA synproxy state" >> $pf_rules
       for inf in `ifconfig -l` ; do
                if `echo $inf | egrep -v 'lo|plip|gif|tun|pfsync' 1>/dev/null` ; then
                        echo "pass on $inf proto icmp all" >> $pf_rules
                        # Allow all outgoing traffic
                        echo "pass out on $inf proto { tcp,udp } from ($inf) to any keep state" >> $pf_rules
                        # Check if we have a /etc/pf.inports file, and open those ports
                        if [ -e "/etc/pf.inports" ]
                        then
                          for PORT in `cat /etc/pf.inports | grep "^udp: " | cut -d " " -f 2`
                          do
                            echo "pass in on $inf proto udp from any to ($inf) port $PORT keep state" >> $pf_rules
                          done
                        fi
                        if [ -e "/etc/pf.inports" ]
                        then
                          for PORT in `cat /etc/pf.inports | grep "^tcp: " | cut -d " " -f 2`
                          do
                            echo "pass in on $inf proto tcp from any to ($inf) port $PORT keep state" >> $pf_rules
                          done
                        fi

                        # Deny all from our blacklist
                        echo "block on $inf from <blacklist> to any" >> $pf_rules
                fi
        done


}


load_rc_config $name
run_rc_command "$1"

# (C) 2006 PC-BSD Software
# Modified Andrei Kolu 27.sept.2006
#
# Revision 0.9.1 Wed Sep 27 23:00:17 EEST 2006
#
# List any ports you wish to have opened for incoming traffic
# Used by the pf_enable script in /etc/rc.d
#
# Example: List any ports you wish opened one at a time
# dns server
# udp: 53
# http server
# tcp: 80
#
# Wider range of ports are described with colon
# Example:
# tcp: 444:555
#
#################################
# Echo
#tcp: 7
# qotd (Quote Of The Day)
# tcp: 17
# FTP data (File Transfer Protocol)
tcp: 20
# FTP (File Transfer Protocol)
tcp: 21
# SSH (Secure Shell)
tcp: 22
# Telnet
tcp: 23
# SMTP (Send Mail Transfer Protocol)
#tcp: 25
# WHOIS
#tcp: 43
# DNS (Domain Name Service)
#tcp: 53
# DHCP (Dynamic Host Control Protocol)
#tcp: 68
# TFTP (Trivial File Transfer Protocol)
#tcp: 69
# Finger
tcp: 79
# HTTP (HyperText Transfer Protocol)
tcp: 80
# POP3 (Post Office Protocol, version 3)
tcp: 110
# Portmapper
#tcp: 111
# SFTP (Secure File Transfer Protocol)
tcp: 115
# NNTP (Network New Transfer Protocol)
tcp: 119
# NTP (Network Time Protocol)
tcp: 123
# NetBIOS-ns
tcp: 137
udp: 137
# NetBIOS-dgm
tcp: 138
udp: 138
# NetBIOS
tcp: 139
udp: 139
# IMAP2 (Internet Message Access Protocol 2)
#tcp: 143
# SNMP (Simple Network Management Protocol)
#tcp: 161
# BGP (Border Gateway Protocol)
#tcp:179
# IRC (Internet Relay Chat)
#tcp: 194
# IMAP3 (Internet Message Access Protocol 3)
#tcp: 220
# LDAP (Lightweight Directory Access Protocol)
#tcp: 389
# SSL (Secure Socket Layer)
#tcp: 443
# SMB (NetBIOS over TCP) if you are using Active Directory NetBIOS was moved to 445 after 2000 and beyond, (CIFS)
tcp: 445
# NNTPS (Secure Network News Transfer Protocol)
#tcp: 563
# IPP (Internet Printing Protocol)
#tcp: 631
# LDAPS (Secure Lightweight Directory Access Protocol)
#tcp: 636
# Doom
#tcp: 666
# SAMBA SWAT service (not related to client communication)
#tcp: 901
# SIMAP (Secure Internet Message Access Protocol)
#tcp: 993
# SPOP (Secure Post Office Protocol)
#tcp: 995

# Ports from 49152 to 65535 are known as Dynamic or Private Ports.
# Ports between 1024 and 29151 are known as the Registered Ports.
# Basically, programs are supposed to register their use of these
# ports and thereby try to be careful and avoid stomping on each other.
# Here are some common ports and their programs:

# SubSeven (Trojan - security risk!)
#tcp: 1243
# Lotus Notes
#tcp: 1352
# Microsoft SQL Server
#tcp: 1433
# Citrix ICA Protocol
#tcp: 1494
# Oracle SQL
#tcp: 1521
# Citrix ICA / Microsoft Terminal Server
#tcp: 1604
# NFS (Network File System)
#tcp: 2049
# MySQL
#tcp: 3306
# ICQ
#tcp: 4000
# Yahoo! Messenger
#tcp: 5010
# AOL Instant Messenger
#tcp: 5190
# PCAnywhere
#tcp: 5632
# VNC
#tcp: 5800
# VNC
#tcp: 5900
# X Windowing System
tcp: 6000:6063
# Napster
#tcp: 6699
# SubSeven (Trojan - security risk!)
#tcp: 6776
# Bittorrent
tcp: 6881:6999
# RealServer / QuickTime
#tcp: 7070
# XFS (X Font Server)
#tcp: 7100
# Unreal
#tcp: 7778
# HTTP Proxy
#tcp: 8080
# Quake
#tcp: 26000
# Half-Life
#tcp: 27010
# Quake III
#tcp: 27960