# Simple PF firewall ruleset for a web server
# Default deny policy
block all

# Allow loopback interface
set skip on lo0

# Scrub incoming packets
match in all scrub (no-df random-id)

# Allow established connections out
pass out keep state

# Allow incoming SSH (rate limited)
pass in on egress proto tcp from any to any port 22 keep state (max-src-conn 15, max-src-conn-rate 5/3, overload <bruteforce> flush global)

# Allow incoming HTTP and HTTPS
pass in on egress proto tcp from any to any port { 80, 443 } keep state

# Allow ICMP ping requests
pass in inet proto icmp all icmp-type echoreq keep state

# Block brute-force attackers
block drop in quick from <bruteforce>