Need to see if I can duplicate the following ruleset in pf:

INPUT blocks

Log and drop things coming from (or going to) clearly bogus addresses

-A INPUT -i eth0 -s 10.0.0.0/8 -j LOG --log-prefix "IP DROP SPOOF "
-A INPUT -i eth0 -s 172.16.0.0/12 -j LOG --log-prefix "IP DROP SPOOF "
-A INPUT -i eth0 -s 192.168.0.0/16 -j LOG --log-prefix "IP DROP SPOOF "
-A INPUT -i eth0 -s 224.0.0.0/4 -j LOG --log-prefix "IP DROP MULTICAST "
-A INPUT -i eth0 -s 240.0.0.0/5 -j LOG --log-prefix "IP DROP SPOOF "
-A INPUT -i eth0 -d 127.0.0.0/8 -j LOG --log-prefix "IP DROP LOOPBACK "
-A INPUT -i eth0 -s 169.254.0.0/16 -j LOG --log-prefix "IP DROP MULTICAST "
-A INPUT -i eth0 -s 0.0.0.0/8 -j LOG --log-prefix "IP DROP "
-A INPUT -i eth0 -s 240.0.0.0/4 -j LOG --log-prefix "IP DROP "
-A INPUT -i eth0 -s 255.255.255.255/32 -j LOG --log-prefix "IP DROP "
-A INPUT -i eth0 -s 168.254.0.0/16 -j LOG --log-prefix "IP DROP "
-A INPUT -i eth0 -s 248.0.0.0/5 -j LOG --log-prefix "IP DROP "

SYN flood protection

-A INPUT -i eth0 -p tcp --syn -m state --state NEW -m limit --limit 2/second --limit-burst 7 -j ACCEPT

ACK scans

-A INPUT -i eth0 -p tcp ! --syn -m state --state NEW -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "Dro>
-A INPUT -i eth0 -p tcp ! --syn -m state --state NEW -j DROP

Block Fragments

-A INPUT -i eth0 -f -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "Fragments Packets"
-A INPUT -i eth0 -f -j DROP

Accept established connections

-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

Accept some ICMP. Limit the number of connections, though, to try and avoid floods.

-A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/sec --limit-burst 7 -j ACCEPT
-A INPUT -p icmp --icmp-type time-exceeded -m limit --limit 1/sec --limit-burst 7 -j ACCEPT
-A INPUT -p icmp --icmp-type destination-unreachable -m limit --limit 1/sec --limit-burst 7 -j ACCEPT

Accept everything coming in on loopback

-A INPUT -i lo -j ACCEPT

For now accept all SSH connections

-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT

Everything else lets log and drop

-A INPUT -j LOG
-A INPUT -j DROP
-A FORWARD -j LOG
-A FORWARD -j DROP

PORTSCAN chain (drop common attacks)

-N PORTSCAN
-A PORTSCAN -p tcp --tcp-flags ACK,FIN FIN -j DROP
-A PORTSCAN -p tcp --tcp-flags ACK,PSH PSH -j DROP
-A PORTSCAN -p tcp --tcp-flags ACK,URG URG -j DROP
-A PORTSCAN -p tcp --tcp-flags FIN,RST FIN,RST -j DROP
-A PORTSCAN -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
-A PORTSCAN -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
-A PORTSCAN -p tcp --tcp-flags ALL ALL -j DROP
-A PORTSCAN -p tcp --tcp-flags ALL NONE -j DROP
-A PORTSCAN -p tcp --tcp-flags ALL FIN,PSH,URG -j DROP
-A PORTSCAN -p tcp --tcp-flags ALL SYN,FIN,PSH,URG -j DROP
-A PORTSCAN -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP