TIP:a nice way to make your pf more "stealth"

[marc]

pass out inet proto icmp all icmp-type 8 code 0 keep state
pass out proto udp all keep state
pass out proto tcp all modulate state

what do you think about it? do you have something better - more useful?

[J65nko]

Those rules don't make an OBSD firewall stealth. Making sure that the block policy is drop does
An alternative could be to use a bridge, where the 2 interfaces have no IP addresses but where you still can filter traffic.

BTW keep state already has been the default for several releases, and thus does not need to be specified anymore

[marc]

Thank you for your suggestions. I`m sort of old-fashioned man.
Well, It looks like there is a sense of putting "drop" rule there.