Re: pf protection against spoofed [source addr] packets

>> 2. What specific rules would you recommend for preventing spoofed
>> packets
>
> people spend too much time on this. make sure nobody spoofs your own
> IPs (or, more precise, any IP you do access control with) and be done
> with it. really, spoofing has to be fought at the source, you can't
> layer. so you want to make sure only packets with your own IPs as src
> leave your network.

Thanks for the insight.

I found a pf ruleset that does this (but not fighting at the source; it 
still allows spoofed packets to be sent _out_).

   set skip on lo
   ext_if = "em0"
   antispoof quick for $ext_if

The antispoof expands to this:

   block drop in quick on ! em0 inet from 64.156.193.0/24 to any
   block drop in quick inet from 64.156.193.115 to any