1 files changed, 36 insertions, 0 deletions
diff --git a/pf Firewall.md b/pf Firewall.md
new file mode 100644
index 0000000..acfe783
--- /dev/null
+++ b/pf Firewall.md
@@ -0,0 +1,36 @@
+### 3. pf Firewall – Basic Hardening
+
+```markdown
+# Hardening OpenBSD with pf (packet filter)
+
+This basic rule set allows only public web traffic (80/443) and WireGuard.
+Everything else – SSH, direct Git, etc. – must go through the VPN.
+
+## Configuration file `/etc/pf.conf`
+
+```pf
+ext_if = egress
+
+# Default deny
+block in log all
+pass out all keep state
+
+# Localhost
+set skip on lo0
+
+# Public services
+pass in on $ext_if proto tcp to any port { 80, 443 } flags S/SA
+
+# WireGuard
+pass in on $ext_if proto udp to any port 51820
+
+# Allow all traffic inside the VPN
+pass in on wg0 all
+pass out on wg0 all
+
+Apply the rules:
+bash
+
+doas pfctl -f /etc/pf.conf
+
+To make them permanent, ensure the file exists (it will be loaded at boot).