first commitHEADmain

1 files changed, 44 insertions, 0 deletions

diff --git a/pf.conf b/pf.conf
new file mode 100644
index 0000000..82f0d97
--- /dev/null
+++ b/pf.conf
@@ -0,0 +1,44 @@
+set skip on lo
+set block-policy drop
+set optimization conservative
+set state-policy if-bound
+set ruleset-optimization basic
+
+wanint="vtnet0"
+
+# WireGuard Configuration
+wg_ifs  = "{ wg0, wg1 }"
+wg_net = "10.1.0.0/24"
+wg_ports="{51820}"
+table <wg_clients> const { 10.1.0.2, 10.1.0.4, 10.1.0.22 }
+
+#### -- Scrub Rules -- ####
+scrub in on $wanint all random-id max-mss 1360
+scrub out on $wanint all random-id max-mss 1360
+scrub in all
+scrub out all
+
+#### -- NAT Rules -- ####
+# WireGuard Clients NAT
+nat on $wanint inet from <wg_clients> to any -> ($wanint)
+
+block all
+
+#### -- Fail2Ban Rules -- ####
+anchor "f2b/*"
+
+pass out quick keep state
+
+#### -- UDP Rules -- ####
+pass in quick on $wg_ifs from $wg_net to any keep state
+pass in quick on $wanint proto udp from any to ($wanint) port $wg_ports keep state
+
+# HTTP/3 Protocol
+pass in quick on $wanint proto udp to ($wanint) port 443 keep state
+
+#### -- TCP Rules -- ####
+# Mail Protocols
+pass in quick proto tcp from any to ($wanint) port {25, 465, 587, 993, 995} synproxy state
+
+# HTTP
+pass in quick on $wanint proto tcp to ($wanint) port {80, 443} modulate state