freebsd-12-stable/etc/rc.firewall

86 	${fwcmd} add 200 deny all from any to 127.0.0.0/8
87 	${fwcmd} add 300 deny ip from 127.0.0.0/8 to any
89 		${fwcmd} add 400 deny all from any to ::1
90 		${fwcmd} add 500 deny all from ::1 to any
248 	${fwcmd} add deny tcp from any to any setup
292 	${fwcmd} add deny all from ${inet} to any in via ${oif}
293 	${fwcmd} add deny all from ${onet} to any in via ${iif}
295 		${fwcmd} add deny all from ${inet6} to any in via ${oif6}
297 			${fwcmd} add deny all from ${onet6} to any in \
318 	${fwcmd} add deny all from any to "table($BAD_ADDR_TBL)" via ${oif}
324 	# translated by natd(8) would match the `deny' rule above.  Similarly
326 	# match the `deny' rule below.
335 	${fwcmd} add deny all from "table($BAD_ADDR_TBL)" to any via ${oif}
338 		${fwcmd} add deny all from fc00::/7 to any via ${oif6}
339 		${fwcmd} add deny all from any to fc00::/7 via ${oif6}
342 		${fwcmd} add deny all from fec0::/10 to any via ${oif6}
343 		${fwcmd} add deny all from any to fec0::/10 via ${oif6}
346 		${fwcmd} add deny all from ::ffff:0.0.0.0/96 to any \
348 		${fwcmd} add deny all from any to ::ffff:0.0.0.0/96 \
352 		${fwcmd} add deny all from ::224.0.0.0/100 to any via ${oif6}
353 		${fwcmd} add deny all from any to ::224.0.0.0/100 via ${oif6}
354 		${fwcmd} add deny all from ::127.0.0.0/104 to any via ${oif6}
355 		${fwcmd} add deny all from any to ::127.0.0.0/104 via ${oif6}
356 		${fwcmd} add deny all from ::0.0.0.0/104 to any via ${oif6}
357 		${fwcmd} add deny all from any to ::0.0.0.0/104 via ${oif6}
358 		${fwcmd} add deny all from ::255.0.0.0/104 to any via ${oif6}
359 		${fwcmd} add deny all from any to ::255.0.0.0/104 via ${oif6}
361 		${fwcmd} add deny all from ::0.0.0.0/96 to any via ${oif6}
362 		${fwcmd} add deny all from any to ::0.0.0.0/96 via ${oif6}
365 		${fwcmd} add deny all from 2002:e000::/20 to any via ${oif6}
366 		${fwcmd} add deny all from any to 2002:e000::/20 via ${oif6}
367 		${fwcmd} add deny all from 2002:7f00::/24 to any via ${oif6}
368 		${fwcmd} add deny all from any to 2002:7f00::/24 via ${oif6}
369 		${fwcmd} add deny all from 2002:0000::/24 to any via ${oif6}
370 		${fwcmd} add deny all from any to 2002:0000::/24 via ${oif6}
371 		${fwcmd} add deny all from 2002:ff00::/24 to any via ${oif6}
372 		${fwcmd} add deny all from any to 2002:ff00::/24 via ${oif6}
374 		${fwcmd} add deny all from 2002:0a00::/24 to any via ${oif6}
375 		${fwcmd} add deny all from any to 2002:0a00::/24 via ${oif6}
376 		${fwcmd} add deny all from 2002:ac10::/28 to any via ${oif6}
377 		${fwcmd} add deny all from any to 2002:ac10::/28 via ${oif6}
378 		${fwcmd} add deny all from 2002:c0a8::/32 to any via ${oif6}
379 		${fwcmd} add deny all from any to 2002:c0a8::/32 via ${oif6}
381 		${fwcmd} add deny all from ff05::/16 to any via ${oif6}
382 		${fwcmd} add deny all from any to ff05::/16 via ${oif6}
403 	${fwcmd} add deny log ip4 from any to any in via ${oif} setup proto tcp
405 		${fwcmd} add deny log ip6 from any to any in via ${oif6} \
523 	  ${fwcmd} add deny { tcp or udp } from any to any $i in
527 	${fwcmd} add deny ip  from any to 255.255.255.255
528 	${fwcmd} add deny ip  from any to 224.0.0.0/24 in	# XXX
531 	${fwcmd} add deny udp from any to any 520 in
536 	${fwcmd} add deny tcp from any 80,443 to any 1024-65535 in
544 	${fwcmd} add deny $log ip from any to any
548 	${fwcmd} add 65000 deny ip from any to any