patmaddox · February 1, 2023 01:41
diff --git a/pf.conf b/pf.conf
 ext_if="ena0"
 ts_if="tailscale0"

 set skip on lo
 scrub in

 # permissive NAT allows jail bridge and wireguard tunnels
 nat on $ext_if inet from !($ext_if) -> ($ext_if:0)

 block in
 pass out

 pass in proto tcp to port { 22 }
 pass in inet proto icmp icmp-type { echoreq }
	ext_if="ena0"
	ts_if="tailscale0"

	set skip on lo
	scrub in

	# permissive NAT allows jail bridge and wireguard tunnels
	nat on $ext_if inet from !($ext_if) -> ($ext_if:0)

	block in
	pass out

	pass in proto tcp to port { 22 }
	pass in inet proto icmp icmp-type { echoreq }