rules.conf.standalone

#
# These rules are an example for a stand-alone system (eg, a desktop or web
# server) rather than a box that is functioning as a router with multiple
# network cards.
#
include helpers/icmp.conf
include helpers/icmpv6.conf

define rules SSH_ALLOWED
accept ip 4 source address home.example.com		        # Only IPv4 from home.example.com
accept ip both source address work.example.com	      # IPv4 and IPv6 from work.example.com
accept ip 6 source address 2001:55cc:4141::2652:9338	# IPv6 Host
accept ip 6 source address 2001:55cc:4141:d1d4::/64	  # IPv6 Subnet
reject ip both all
end define

define rules NET to ME
accept ip both protocol udp ports ntp,domain
accept ip both protocol tcp ports smtp,domain
accept ip both protocol tcp ports http,https
SSH_ALLOWED ip both protocol tcp port ssh
end define

define rules OUTPUT
accept ip both
end define

define rules INPUT
ICMP ip 4 protocol icmp
ICMP6 ip 6 protocol icmpv6
#
drop ip both protocol tcp ports 135,137,138,139,445	# ignore annoying windows traffic
drop ip both protocol udp ports 135,137,138,139,445	# ignore annoying windows traffic
end define

# Standard stuff
common loopback
# "common bogon" is disabled by default because it is too easy to lock yourself
# out. enable it after you have read the documentation, understand it and are
# sure it won't lock you out of your system remotely.
#common bogon NET # disabled by default because it is too easy to lock yourself out
common xmas NET
common syn NET
common portscan NET