### 3. pf Firewall – Basic Hardening

```markdown
# Hardening OpenBSD with pf (packet filter)

This basic rule set allows only public web traffic (80/443) and WireGuard.
Everything else – SSH, direct Git, etc. – must go through the VPN.

## Configuration file `/etc/pf.conf`

```pf
ext_if = egress

# Default deny
block in log all
pass out all keep state

# Localhost
set skip on lo0

# Public services
pass in on $ext_if proto tcp to any port { 80, 443 } flags S/SA

# WireGuard
pass in on $ext_if proto udp to any port 51820

# Allow all traffic inside the VPN
pass in on wg0 all
pass out on wg0 all

Apply the rules:
bash

doas pfctl -f /etc/pf.conf

To make them permanent, ensure the file exists (it will be loaded at boot).