pf

On a workstation where you are the only user, you can use a very simple /etc/pf.conf:

set skip on lo0 # don't filter localhost packets
ext_if = "em0" # replace em0 with your external interface
set block-policy drop # by default, drop packets. You can also set block-policy reject
set loginterface $ext_if # log that interface
block all  # block all traffic by default
pass in inet proto icmp icmp-type 8 code 0 # icmp packets
pass in inet proto icmp icmp-type 3 code 4 # icmp needfrag (MTU)
pass in inet6 proto ipv6-icmp icmp6-type {2 128} keep state
pass out all # pass all outgoing traffic

This will allow the necessary ICMP traffic (useful for network diagnosis) while blocking all other incoming connections.

(As a general rule, the last matching rule determines the action.)

I generally don't whitelist by IP addresses because I've had times where I needed to access a system from a different IP. I also avoid OS fingerprinting because, although it is available, it's not 100%25 accurate.

To load the ruleset once you've edited it, run:

$ doas pfctl -f /etc/pf.conf

To disable the firewall (useful for diagnosing the network), run:

$ doas pfctl -d

To enable it again:

$ doas pfctl -e

For a server, you will want to, at a minimum, allow incoming ssh packets:

set skip on lo0 # don't filter localhost packets
ext_if = "em0" # my external interface is em0
set block-policy drop # by default, drop packets. You can also set block-policy reject
set loginterface $ext_if # log that interface
pass in proto tcp from 192.168.1.1 to port ssh
pass in inet proto icmp icmp-type 8 code 0 # icmp packets
pass in inet proto icmp icmp-type 3 code 4 # icmp needfrag (MTU)
pass in inet6 proto ipv6-icmp icmp6-type {2 128} keep state
pass out all # pass all outgoing traffic

Replace 192.168.1.1 with your IP.

As a general rule, your servers should also accept incoming http and https connections. This is necessary for running a web server and also for acquiring a properly signed SSL certificate. Here is the /etc/pf.conf:

set skip on lo0 # don't filter localhost packets
ext_if = "em0" # my external interface is em0
set block-policy drop # by default, drop packets. You can also set block-policy reject
set loginterface $ext_if # log that interface
pass in proto tcp from 192.168.1.1 to port ssh
pass in inet proto icmp icmp-type 8 code 0 # icmp packets
pass in inet proto icmp icmp-type 3 code 4 # icmp needfrag (MTU)
pass in inet6 proto ipv6-icmp icmp6-type {2 128} keep state
pass in proto tcp to port {http https}
pass out all # pass all outgoing traffic

To see how many packets are arriving:

$ doas pfctl -f /etc/pf.conf

This will empty the existing state tables for pf. Then, run

$ doas pfctl -sr -v

This will show you how many packets are arriving. Since you emptied the state tables, if you now see 1000s of packets coming in, those packets came in the last few seconds, indicating that you are certainly under attack.