blob: acfe7837a4240e128e7f8a947babea14fbcb944a (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
|
### 3. pf Firewall – Basic Hardening
```markdown
# Hardening OpenBSD with pf (packet filter)
This basic rule set allows only public web traffic (80/443) and WireGuard.
Everything else – SSH, direct Git, etc. – must go through the VPN.
## Configuration file `/etc/pf.conf`
```pf
ext_if = egress
# Default deny
block in log all
pass out all keep state
# Localhost
set skip on lo0
# Public services
pass in on $ext_if proto tcp to any port { 80, 443 } flags S/SA
# WireGuard
pass in on $ext_if proto udp to any port 51820
# Allow all traffic inside the VPN
pass in on wg0 all
pass out on wg0 all
Apply the rules:
bash
doas pfctl -f /etc/pf.conf
To make them permanent, ensure the file exists (it will be loaded at boot).
|
