From e1209d926631e495ee29137fd62c51e1dd324663 Mon Sep 17 00:00:00 2001
From: Sadeep Madurange <sadeep@asciimx.com>
Date: Fri, 18 Sep 2026 18:18:00 +0800
Subject: PF config.

---
 conf/pf.conf | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)
 create mode 100644 conf/pf.conf

(limited to 'conf/pf.conf')

diff --git a/conf/pf.conf b/conf/pf.conf
new file mode 100644
index 0000000..ee387f5
--- /dev/null
+++ b/conf/pf.conf
@@ -0,0 +1,27 @@
+#	$OpenBSD: pf.conf,v 1.55 2017/12/03 20:40:04 sthen Exp $
+#
+# See pf.conf(5) and /etc/examples/pf.conf
+
+net_if="localnet"
+vps="xxx.xx.xxx.xxx"
+home_net="xxx.xxx.x.x/xx"
+router="xxx.xxx.x.x"
+
+set skip on lo
+block all
+
+# Block all outgoing traffic to local network 
+block out on $net_if to $home_net
+
+# Allow outbound to router for DNS
+pass out on $net_if proto { tcp, udp } to $router port domain
+
+# Allow outbound SSH to VPS 
+pass out on $net_if inet proto tcp from ($net_if) to $vps port ssh
+
+# Allow NTP and HTTPS outbound to the internet; exclude local network
+pass out on $net_if proto udp to ! $home_net port ntp
+pass out on $net_if proto tcp to ! $home_net port https
+
+# Allow inbound SSH from local network management hosts
+pass in on $net_if inet proto tcp from $home_net to ($net_if) port ssh
-- 
cgit v1.2.3