The Book of PF

First Rule Set—A Single, Stand-Alone Machine

This is the simplest possible setup: a single machine that will not run any services, talking to only one network (which may be the Internet).

For now, we will use a /etc/pf.conf file that looks like this:

block in all
pass out all keep state

This rule set denies any incoming traffic, allows traffic we make ourselves, and retains state information on our connections. That's the way rules are evaluated in PF configurations: The rules are read from top to bottom, and the last rule in your rule set that matches for the packet or connection is the one that will be applied. That's all you need to know about the matter at this point. We will be looking at evaluation order later when the rule sets grow a bit ...