1*0Sstevel@tonic-gate# 2*0Sstevel@tonic-gate# log all inbound packet on le0 which has IP options present 3*0Sstevel@tonic-gate# 4*0Sstevel@tonic-gatelog in on le0 from any to any with ipopts 5*0Sstevel@tonic-gate# 6*0Sstevel@tonic-gate# block any inbound packets on le0 which are fragmented and "too short" to 7*0Sstevel@tonic-gate# do any meaningful comparison on. This actually only applies to TCP 8*0Sstevel@tonic-gate# packets which can be missing the flags/ports (depending on which part 9*0Sstevel@tonic-gate# of the fragment you see). 10*0Sstevel@tonic-gate# 11*0Sstevel@tonic-gateblock in log quick on le0 from any to any with short frag 12*0Sstevel@tonic-gate# 13*0Sstevel@tonic-gate# log all inbound TCP packets with the SYN flag (only) set 14*0Sstevel@tonic-gate# (NOTE: if it were an inbound TCP packet with the SYN flag set and it 15*0Sstevel@tonic-gate# had IP options present, this rule and the above would cause it 16*0Sstevel@tonic-gate# to be logged twice). 17*0Sstevel@tonic-gate# 18*0Sstevel@tonic-gatelog in on le0 proto tcp from any to any flags S/SA 19*0Sstevel@tonic-gate# 20*0Sstevel@tonic-gate# block and log any inbound ICMP unreachables 21*0Sstevel@tonic-gate# 22*0Sstevel@tonic-gateblock in log on le0 proto icmp from any to any icmp-type unreach 23*0Sstevel@tonic-gate# 24*0Sstevel@tonic-gate# block and log any inbound UDP packets on le0 which are going to port 2049 25*0Sstevel@tonic-gate# (the NFS port). 26*0Sstevel@tonic-gate# 27*0Sstevel@tonic-gateblock in log on le0 proto udp from any to any port = 2049 28*0Sstevel@tonic-gate# 29*0Sstevel@tonic-gate# quickly allow any packets to/from a particular pair of hosts 30*0Sstevel@tonic-gate# 31*0Sstevel@tonic-gatepass in quick from any to 10.1.3.2/32 32*0Sstevel@tonic-gatepass in quick from any to 10.1.0.13/32 33*0Sstevel@tonic-gatepass in quick from 10.1.3.2/32 to any 34*0Sstevel@tonic-gatepass in quick from 10.1.0.13/32 to any 35*0Sstevel@tonic-gate# 36*0Sstevel@tonic-gate# block (and stop matching) any packet with IP options present. 37*0Sstevel@tonic-gate# 38*0Sstevel@tonic-gateblock in quick on le0 from any to any with ipopts 39*0Sstevel@tonic-gate# 40*0Sstevel@tonic-gate# allow any packet through 41*0Sstevel@tonic-gate# 42*0Sstevel@tonic-gatepass in from any to any 43*0Sstevel@tonic-gate# 44*0Sstevel@tonic-gate# block any inbound UDP packets destined for these subnets. 45*0Sstevel@tonic-gate# 46*0Sstevel@tonic-gateblock in on le0 proto udp from any to 10.1.3.0/24 47*0Sstevel@tonic-gateblock in on le0 proto udp from any to 10.1.1.0/24 48*0Sstevel@tonic-gateblock in on le0 proto udp from any to 10.1.2.0/24 49*0Sstevel@tonic-gate# 50*0Sstevel@tonic-gate# block any inbound TCP packets with only the SYN flag set that are 51*0Sstevel@tonic-gate# destined for these subnets. 52*0Sstevel@tonic-gate# 53*0Sstevel@tonic-gateblock in on le0 proto tcp from any to 10.1.3.0/24 flags S/SA 54*0Sstevel@tonic-gateblock in on le0 proto tcp from any to 10.1.2.0/24 flags S/SA 55*0Sstevel@tonic-gateblock in on le0 proto tcp from any to 10.1.1.0/24 flags S/SA 56*0Sstevel@tonic-gate# 57*0Sstevel@tonic-gate# block any inbound ICMP packets destined for these subnets. 58*0Sstevel@tonic-gate# 59*0Sstevel@tonic-gateblock in on le0 proto icmp from any to 10.1.3.0/24 60*0Sstevel@tonic-gateblock in on le0 proto icmp from any to 10.1.1.0/24 61*0Sstevel@tonic-gateblock in on le0 proto icmp from any to 10.1.2.0/24 62