Firewall/NAT

Here are some of the basic firewall rules I use when deploying a m0n0wall in a small business ( 5 to 50 users)

Basic LAN security, these rules stop spam bots and DNS HiJajck. These must be applied to the Wireless interface as well.  
Please see the attached PDF. Any suggestions and additions are welcome. I hope this answers questions for others

-Phil Vogler

addendum for wireless interface -

Update/workaround

On the wireless interface only ( Tested only with Athros based cards) This allows DNS lookup to the m0n0wall or internal DNS server while blocking alternate DNS lookups. Why this must be applied on wireless and not on the LAN interface baffles me but I am guessing it is a driver issue

            Proto           Source            Port                 Destination         Port            Description   
   
(Reject)  TCP        ! 192.168.10.2         *                         *               25 (SMTP)        SMTP Block     
   
(Pass)    UDP                   *                *                192.168.10.2       53 (DNS)         <- must be added
   
(Reject)  UDP     ! 192.168.10.2          *                          *                53 (DNS)        DNS HiJack Block
   
(Pass)       *           LAN net                *                          *                        *            Default Wireless -> any