<ul>
<li><p>Where you can go to get your copy of the fuguita OS.<br />
<a href="https://fuguita.org" class="uri">https://fuguita.org</a></p></li>
<li><p>Additional book references.<br />
<a href="https://nostarch.com/pf3" class="uri">https://nostarch.com/pf3</a><br />
<a href="https://nostarch.com/obenbsd2e" class="uri">https://nostarch.com/obenbsd2e</a></p></li>
</ul>
<p>The files I cover in the <code>/etc/</code> directory first..</p>
<p><code>dhclient.conf</code></p>
<pre><code>interface &quot;em0&quot; {
#      ignore domain-name-servers;
      reject 192.168.1.1;
}
#supersede domain-name-servers 127.0.0.1;</code></pre>
<p><code>dhcpd.conf</code></p>
<pre><code>option domain-name-servers 192.168.1.1;
subnet 192.168.1.0 netmask 255.255.255.0 {
        option routers 192.168.1.1;
        range 192.168.1.40 192.168.1.190;
        host myserver {
                fixed-address 192.168.1.2;
                hardware ethernet 00:00:00:00:00:00;
                }
        host darkstar {
                fixed-address 192.168.1.210;
                hardware ethernet a0:d3:7a:42:aa:1d;
                }
        host zenbig   {
                fixed-address  192.168.1.215;
                hardware ethernet 14:d6:4d:aa:6c:c6;
                }
        host zenstar  {
                fixed-address 192.168.1.205;
                hardware ethernet 2c:6e:85:bf:72:91;
                }
        host mini10   {
                fixed-address 192.168.1.200;
                hardware ethernet 88:25:2C:B2:94:8C;
                }
        host nexus9   {
                fixed-address 192.168.1.195;
                hardware ethernet 44:91:60:9e:d2:73;
                }
        host diningpi {
                fixed-address 192.168.1.197;
                hardware ethernet b8:27:eb:09:bb:1e;
                }
        host think330 {
                fixed-address 192.168.1.193;
                hardware ethernet 50:5B:C2:E5:CA:F5;
                }
        host largedongle1 {
                fixed-address 192.168.1.211;
                hardware ethernet 00:C0:CA:82:EC:30;
                }
        host largedongle2 {
                fixed-address 192.168.1.212;
                hardware ethernet 00:C0:CA:82:E6:29;
                }</code></pre>
<p><code>dhcpd.interfaces</code></p>
<pre><code>athn0</code></pre>
<p><code>hostname.athn0</code></p>
<pre><code>inet            192.168.1.5    255.255.255.0    192.168.1.255
media           autoselect
mediaopt        hostap
chan            4
wpa
nwid            fuguserv
wpakey          1234567890ABCD#
up</code></pre>
<p><code>hostname.bridge0</code></p>
<pre><code>add vether0
add em0
add athn0
blocknonip vether0
blocknonip em0
blocknonip athn0
up</code></pre>
<p><code>hostname.em0</code></p>
<pre><code>dhcp
inet6 autoconf</code></pre>
<p><code>hostname.vether0</code></p>
<pre><code>inet 192.168.1.1 255.255.255.0 192.168.1.255</code></pre>
<p><code>pf.conf</code></p>
<pre><code>nt_if=&quot;{ vether0 em0 athn0 }&quot;
broken=&quot;224.0.0.22 127.0.0.0/8 192.168.0.0/16 172.16.0.0/12
        10.0.0.0/8 169.254.0.0/16 192.0.2.0/24
        198.51.100.0/24, 203.0.113.0/24,
        169.254.0.0/16 0.0.0.0/8 240.0.0.0/4 255.255.255.255/32&quot;
table &lt;bruteforce&gt; persist
set block-policy drop
set loginterface egress
set skip on lo0
match in all scrub (no-df random-id max-mss 1440)
match out on egress inet from !(egress:network) to any nat-to (egress:0)
antispoof quick for (egress)
block quick from &lt;bruteforce&gt;
block in quick on egress from { $broken no-route urpf-failed } to any
block in quick inet6 all
block return out quick inet6 all
#block return out quick log on egress proto { tcp udp } from any to any port 53
block return out quick log on egress from any to { no-route $broken }
block in all
pass out quick inet keep state
pass in on $int_if inet
pass in on egress inet proto tcp from any to (egress) port 22 keep state (max-src-conn 40, max-src-conn-rate 40/172800 ,overload &lt;bruteforce&gt; flush global)
pass in quick on $int_if proto udp from any to ! 192.168.1.1 port 123 rdr-to 192.168.1.1</code></pre>
<p><code>sysctl.conf</code></p>
<pre><code>net.inet.ip.forwarding=1
net.inet.ip.redirect=0
kern.bufcachepercent=50
net.inet.ip.ifq.maxlen=1024
net.inet.tcp.mssdflt=1440
machdep.allowaperture=2 # See xf86(4)
machdep.lidaction=0
net.inet6.ip6.forwarding=0
net.inet6.ip6.mforwarding=0
hw.smt=1</code></pre>
<p><code>rc.conf.local</code></p>
<pre><code>check_quotas=NO
dhcpd_flags=&quot;vether0&quot;
ntpd_flags=&quot;&quot;
#pkg_scripts=dnscrypt_proxy -config /etc/dnscrypt-proxy.toml
sndiod_flags=NO
unbound_flags=&quot;&quot;</code></pre>
<p><code>/var/unbound/etc/unbound.conf</code></p>
<pre><code># $OpenBSD: unbound.conf,v 1.14 2018/12/16 20:41:30 tim Exp $
server:
    username: _unbound
    directory: /var/unbound
    chroot: /var/unbound

    interface: 192.168.1.1
    interface: 127.0.0.1
    do-ip6: no

    access-control: 127.0.0.0/8 allow
    access-control: 192.168.1.0/24 allow
    hide-identity: yes
    hide-version: yes
    do-not-query-localhost: no

    tcp-upstream: yes

    private-address: 10.0.0.0/8
    private-address: 172.16.0.0/12
    private-address: 192.168.0.0/16

remote-control:
        control-enable: yes
        control-use-cert: no
        control-interface: /var/run/unbound.sock

forward-zone:
    name: &quot;.&quot;
    forward-addr: 127.0.0.1</code></pre>
