From 0c571e15ada243d90531949715bdc3d3ae2fbd55 Mon Sep 17 00:00:00 2001
From: escfrpls <licwin1410@gmail.com>
Date: Sun, 10 May 2026 15:14:34 +0200
Subject: new notes

---
 pf Firewall.md | 36 ++++++++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)
 create mode 100644 pf Firewall.md

(limited to 'pf Firewall.md')

diff --git a/pf Firewall.md b/pf Firewall.md
new file mode 100644
index 0000000..acfe783
--- /dev/null
+++ b/pf Firewall.md	
@@ -0,0 +1,36 @@
+### 3. pf Firewall – Basic Hardening
+
+```markdown
+# Hardening OpenBSD with pf (packet filter)
+
+This basic rule set allows only public web traffic (80/443) and WireGuard.
+Everything else – SSH, direct Git, etc. – must go through the VPN.
+
+## Configuration file `/etc/pf.conf`
+
+```pf
+ext_if = egress
+
+# Default deny
+block in log all
+pass out all keep state
+
+# Localhost
+set skip on lo0
+
+# Public services
+pass in on $ext_if proto tcp to any port { 80, 443 } flags S/SA
+
+# WireGuard
+pass in on $ext_if proto udp to any port 51820
+
+# Allow all traffic inside the VPN
+pass in on wg0 all
+pass out on wg0 all
+
+Apply the rules:
+bash
+
+doas pfctl -f /etc/pf.conf
+
+To make them permanent, ensure the file exists (it will be loaded at boot).
-- 
cgit v1.2.3