OpenBSD Jumpstart 8.0

# Display the current configuration of network interfaces
ifconfig

# Set DHCP for 're0' interface, on the fly
ifconfig re0 inet autoconf

# Perform network (re)initialisation
sh /etc/netstart

# Show the routing table (ipv4)
route -n show -inet

# Show the routing table (ipv6)
route -n show -inet6

# Delete all gateway entries from the routing table
route -n flush

# Disable PF (removes all filtering)
pfctl -d

# Check the rules, always before loading them
pfctl -nf /etc/pf.conf

# Enable PF and load the rules
pfctl -ef /etc/pf.conf

# Just load the rules (apply changes)
pfctl -f /etc/pf.conf

# View the loaded rules
pfctl -s rules

# Protect a laptop (allow only ping/ssh from anywhere, IPv4 only)
# SSH protected by source limiter

set skip on lo

source limiter "ssh-protect" id 1 \
        entries 10000 limit 3 rate 5/60

block log all
pass in on egress inet proto icmp all icmp-type echoreq
pass in on egress inet proto tcp from any to any port ssh \
        source limiter "ssh-protect"
pass out

# Watch PF logs
tcpdump -nettti pflog0

# Watch traffic on egress (no DNS resolution)
tcpdump -n -i egress

# Filter by host / by port
tcpdump -n host 192.168.1.100
tcpdump -n port 22

# Watch DNS queries
tcpdump -n udp port 53

# Save capture to file / read it back
tcpdump -w capture.pcap -i egress
tcpdump -r capture.pcap

# By default, it already contains an OpenBSD mirror server URL
https://cdn.openbsd.org/pub/OpenBSD

# Search for packages
pkg_info -Q foobar

# For example, to install Squid
pkg_add squid

# Update packages
pkg_add -u

# 1. Port 80 server only in /etc/httpd.conf (sample below)
rcctl enable httpd
rcctl start httpd

# 2. Get the certificate (replace example.com first)
cp /etc/examples/acme-client.conf /etc/
acme-client -v example.com

# 3. Add the tls server, test, reload
httpd -n && rcctl reload httpd

# 4. Renew automatically, in root's crontab
~ * * * * acme-client example.com && rcctl reload httpd

server "example.com" {
    listen on * port 80
    location "/.well-known/acme-challenge/*" {
        root "/acme"
        request strip 2
    }
    location "*" {
        block return 301 "https://$HTTP_HOST$REQUEST_URI"
    }
}

server "example.com" {
    listen on * tls port 443
    tls certificate "/etc/ssl/example.com.fullchain.pem"
    tls key "/etc/ssl/private/example.com.key"
}

# Inside a server block

# Response headers ("always" adds them to 4xx/5xx errors too)
header set "X-Content-Type-Options" "nosniff" always
header set "X-Frame-Options" "DENY" always

# Refuse requests on a header (AI crawlers, scanners),
# but a User-Agent is easy to fake
header block "User-Agent" "*GPTBot*" 403
header block "User-Agent" "*ClaudeBot*" 403
header drop "User-Agent" "*WPScan*"

# Check CPU support, get vmm-firmware, enable the hypervisor
dmesg | egrep '(VMX/EPT|SVM/RVI)'
fw_update
rcctl enable vmd
rcctl start vmd

# Create a disk, boot install80.iso (2 VCPUs, local network)
vmctl create -s 20G disk.qcow2
vmctl start -m 1G -p 2 -L -i 1 -r install80.iso -d disk.qcow2 myvm

# List VMs, attach the console (leave with ~.), stop
vmctl show
vmctl console myvm
vmctl stop myvm