Set Up a Basic Firewall on FreeBSD

I use Packet Filter (PF) to set up a basic firewall on FreeBSD. To start, the only service I’m running that requires inbound access is SSH. SSHGuard is added for an additional layer of security. Start Here Enable PF SSHGuard ICMP Final Config Resources Start Here PF requires a ruleset configuration file to operate. Example rulesets are found in /usr/share/examples/pf/. I implement a basic ruleset by creating the /etc/pf.conf file with: tcp_services = "{ ssh }" scrub in all block in all pass out all keep state pass in proto tcp to port $tcp_services This blocks all inbound traffic by default, with the exception of ssh, and allows all outbound traffic to pass. Enable PF Set the pf kernel module to be loaded by adding to /etc/rc.conf: doas sysrc pf_enable=YES Add a line which specifies the path to the ruleset file: doas sysrc pf_rules=/etc/pf.conf Enable logging support, provided by pflog(4), by adding: doas sysrc pflog_enable=YES Reboot. SSH connections are allowed in. Everything else…