Skip to content

Instantly share code, notes, and snippets.

@bruienne

bruienne/myorg.pf.rules

Created April 4, 2016 18:32
Show Gist options
  • Star 3 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save bruienne/e990fb62ac76eeaeeea3aca55c9983d6 to your computer and use it in GitHub Desktop.
Save bruienne/e990fb62ac76eeaeeea3aca55c9983d6 to your computer and use it in GitHub Desktop.
Download ZIP
Generic ruleset to block SSH and ARD from unknown IPs
Raw
myorg.pf.rules
# Allow trusted addresses to get to SSH and Apple remote desktop.
# Ports filtered - add more ports to allow more services as needed
# 22/tcp: ssh
# 3283/tcp: Apple Remote Desktop
# 3283/udp: Apple Remote Desktop
# 5900/tcp: Apple Remote Desktop/VNC
incoming_services_tcp = "{ 22, 3283, 5900 }"
incoming_services_udp = "{ 3283 }"
# Networks allowed for access - change to your org's IP ranges using slash notation or individual IP addresses
allowed_networks = "{ 1.2.0.0/16, 2.3.4.0/24 }"
# localhost allow
set skip on lo0
# Normalization
scrub in all no-df
# Allow incoming ports for whitelisted org's networks
pass in quick proto tcp from $allowed_networks to any port $incoming_services_tcp
pass in quick proto udp from $allowed_networks to any port $incoming_services_udp
# Block from other networks
block drop in quick proto tcp from any to any port $incoming_services_tcp
block drop in quick proto udp from any to any port $incoming_services_udp
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment