Мой конфиг.
ext_if="re0" # Internet
int_if="xl0" # Local network
internal_net="192.168.100.0/24"
external_addr="111.111.111.111"
table <admin> { 192.168.100.72 }
table <cs> { 62.181.56.253 }
##################RFC1918##########
table <RFC1918> const {!192.168.0.0/24,0.0.0.0/8,1.0.0.0/8,2.0.0.0/8,5.0.0.0/8,7.0.0.0/8,10.0.0.0/8,23.0.0.0/8,27.0.0.0/8,31.0.0.0/8,36.0.0.0/8,37.0.0.0/8,39.
0.0.0/8, \
41.0.0.0/8,42.0.0.0/8,49.0.0.0/8,50.0.0.0/8,73.0.0.0/8,74.0.0.0/8,75.0.0.0/8,76.0.0.0/8,77.0.0.0/8,78.0.0.0/8, \
79.0.0.0/8,89.0.0.0/8,90.0.0.0/8,91.0.0.0/8,92.0.0.0/8,93.0.0.0/8,94.0.0.0/8,95.0.0.0/8,96.0.0.0/8, \
97.0.0.0/8,98.0.0.0/8,99.0.0.0/8,100.0.0.0/8,101.0.0.0/8,102.0.0.0/8,103.0.0.0/8,104.0.0.0/8,105.0.0.0/8,106.0.0.0/8,107.0.0.0/8,108.0.0.0/8,109.0.0.0/8,110.0
.0.0/8, \
111.0.0.0/8,112.0.0.0/8,113.0.0.0/8,114.0.0.0/8,115.0.0.0/8,116.0.0.0/8,117.0.0.0/8,118.0.0.0/8,119.0.0.0/8,120.0.0.0/8,121.0.0.0/8,122.0.0.0/8,123.0.0.0/8,12
4.0.0.0/8,\
125.0.0.0/8,126.0.0.0/8,127.0.0.0/8,169.254.0.0/16,172.16.0.0/12,173.0.0.0/8,174.0.0.0/8,175.0.0.0/8,176.0.0.0/8,177.0.0.0/8,178.0.0.0/8,179.0.0.0/8,180.0.0.0
/8, \
181.0.0.0/8,182.0.0.0/8,183.0.0.0/8,184.0.0.0/8,185.0.0.0/8,186.0.0.0/8,187.0.0.0/8,189.0.0.0/8,190.0.0.0/8,192.0.2.0/24,192.168.0.0/16,197.0.0.0/8,198.18.0.0
/15, \
223.0.0.0/8,224.0.0.0/3}
########################################
# Options: tune the behavior of pf, default values are given.
set timeout { interval 10, frag 30 }
set timeout { tcp.first 120, tcp.opening 30, tcp.established 86400 }
set timeout { tcp.closing 900, tcp.finwait 45, tcp.closed 90 }
set timeout { udp.first 60, udp.single 30, udp.multiple 60 }
set timeout { icmp.first 20, icmp.error 10 }
set timeout { other.first 60, other.single 30, other.multiple 60 }
set timeout { adaptive.start 0, adaptive.end 0 }
set limit { states 10000, frags 5000 }
set loginterface none
set optimization normal
set block-policy drop
set require-order yes
set fingerprints "/etc/pf.os"
# Normalization: reassemble fragments and resolve or reduce traffic ambiguities.
scrub in all
##Squid
nat on $ext_if from $internal_net to any -> ($ext_if)
rdr on $int_if inet proto tcp from any to any port {80,8080,8000} -> 127.0.0.1 port 3128
#DNS
pass out proto tcp to any port domain keep state
pass proto udp to any port domain keep state
# TRACEROUTE
pass out on $ext_if inet proto udp from any to any port 33433 >< 33626 keep state
# PING
pass in inet proto icmp all icmp-type echoreq keep state
#ssh
pass in on $int_if proto tcp from any to $int_if port 22 keep state
pass out on $int_if proto {tcp, udp} all keep state
#icq
pass out quick on $ext_if proto tcp from <admin> to port 5190 modulate state
#Drop spoofed packets IP blocks
block in log quick on $ext_if from { <RFC1918> } to any
block out log quick on $ext_if from any to { <RFC1918> }
#Block NMAP
block quick from any os NMAP
block return-rst in log quick proto tcp all flags FP/FP
block return-rst in log quick proto tcp all flags SE/SE
block return-rst in log quick proto tcp all flags FUP/FUP
Вариант для распечатки
Информационная безопасность (Public)
(??) on 05-Апр-06, 14:43 
