setting up a firewall that blocks all ports and only allow ports needed. do not lock yourself (ssh) out!
modify /etc/rc.d to contain following lines:
pf_enable="YES"
pf_rules="/etc/pf.conf"
create file
/etc/pf.conf and modify following lines (use ifconfig to detect settings) :
ext_if="re0" # replace with actual external interface name i.e., dc0
int_if="lo0" # replace with actual internal interface name i.e., dc1
internal_net="127.0.0.1"
external_addr="138.125.203.14O"
tcp_public_services="{ 21, 22, 25, 53, 80 }"
udp_public_services="{ 21, 22, 25, 53, 80 }"
tcp_priv_services="{ 20, 21, 110, 8009 }"
udp_priv_services="{ 20, 21, 110, 8009 }"
kldload pf
test the rules
pfctl -n -f /etc/pf.conf
apply the rules
pfctl -f /etc/pf.conf
start: /etc/rc.d/pf start