### IPFirewall
options         IPFIREWALL
options         IPFIREWALL_VERBOSE
options         IPFIREWALL_VERBOSE_LIMIT=400
options         IPFIREWALL_DEFAULT_TO_ACCEPT
options         LIBALIAS
options         IPFIREWALL_NAT
options         IPDIVERT
options         IPSTEALTH
options         ROUTETABLES=10
options         DUMMYNET

### Packet Filter
device          pf
device          pflog
device          pfsync
options         ALTQ
options         ALTQ_CBQ        # Class Bases Queuing (CBQ)
options         ALTQ_RED        # Random Early Detection (RED)
options         ALTQ_RIO        # RED In/Out
options         ALTQ_HFSC       # Hierarchical Packet Scheduler (HFSC)
options         ALTQ_PRIQ       # Priority Queuing (PRIQ)
options         ALTQ_NOPCC      # Required for SMP build

### Bridge interfaces
device          if_bridge

### CARP
device          carp

### IPSec
device          enc

### Granularidade de Processamento
options         HZ=2000

### Tunning Apache
options         ACCEPT_FILTER_DATA
options         ACCEPT_FILTER_HTTP

#!/bin/sh
#
# regras do firewall
#

## exemplo de criacao de variaveis

fw="/sbin/ipfw"
pfcmd="/sbin/pfctl"

#
# flush
#
$pfcmd -d
$fw -f flush
$fw -f pipe flush
$fw -f queue flush

# trata loopback
$fw add 10100 allow all from any to any via lo0
$fw add 10110 deny all from any to 127.0.0.1/8
$fw add 10111 deny all from 127.0.0.1/8 to any

# trata problemas comuns
$fw add 10200 deny tcp from any to any frag
$fw add 10210 deny tcp from any to any tcpflags syn,fin
$fw add 10220 deny tcp from any to any tcpflags fin,!ack

# check state
$fw add 10224 check-state

## comando liberando todo o acesso via ssh para o firewall. Em modo stateless

$fw add 100 allow tcp from any to me 22
$fw add 101 allow tcp from me 22 to any

## exempo de outra regra que liberaria o acesso via ssh de qualquer lugar para o firewall. Em modo stateful

#$fw add 100 allow tcp from any to me 22 keep-state

#
# Liberar icmp de todo lugar para todo lugar
#

$fw add 300 allow icmp from any to any

## Liberar DNS para acesso a internet

$fw add 600 allow { tcp or udp } from any to any dst-port 53 keep-state

## Liberar HTTP/HTTPS para acesso a internet

$fw add 900 allow tcp from any to any dst-port 80,443 keep-state

## comando que bloqueia tudo, exceto o que estiver liberado acima desta regra

$fw add 65500 deny all from any to any ## funciona como um firewall de politica fechada, bloqueia tudo exceto o que ja esta liberado acima desta reg

$pfcmd -e
$pfcmd -f /etc/pf.conf