A Simple PF Rule Set: A Single, Stand-Alone Machine
Mainly to have a common, minimal baseline, we will start building rule sets from the simplest possible configuration.
A Minimal Rule Set
The simplest possible PF setup is on a single machine that will not run any services and talks to only one network (which may be the Internet).
We’ll begin with an /etc/pf.conf file that looks like this:
block in all pass out all keep state
This rule set denies all incoming traffic, allows traffic we send, and retains state information on our connections. PF reads rules from top to bottom; the last rule in a rule set that matches a packet or connection is the one that is applied.
Here, any connection coming into our system from anywhere else will match the block in ...
Get The Book of PF, 2nd Edition now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
