给用ipfw的同志，一个不错的脚本。

#!/bin/sh
#
# Automatically generated by Plesk netconf
#

set -e

/sbin/sysctl net.inet.ip.forwarding=0 >/dev/null
/sbin/ipfw -q list >/dev/null 2>&1 || /sbin/kldload ipfw
(/sbin/ipf -D) >/dev/null 2>&1 || true
(/sbin/kldunload ipl) >/dev/null 2>&1 || true
(/sbin/pfctl -d) >/dev/null 2>&1 || true
(/sbin/kldunload pf) >/dev/null 2>&1 || true
/sbin/ipfw -q /dev/stdin << EOF
flush
delete set 31
add allow ip from any to any via lo0
add check-state
add reset tcp from any to any established

add allow tcp from any to me 8443 setup in keep-state

add allow tcp from any to me 80 setup in keep-state
add allow tcp from any to me 443 setup in keep-state

add allow tcp from any to me 21 setup in keep-state

add allow tcp from any to me 22 setup in keep-state

add allow tcp from any to me 25 setup in keep-state
add allow tcp from any to me 465 setup in keep-state

add allow tcp from any to me 110 setup in keep-state
add allow tcp from any to me 995 setup in keep-state

add allow tcp from any to me 143 setup in keep-state
add allow tcp from any to me 993 setup in keep-state

add allow tcp from any to me 106 setup in keep-state

add allow tcp from any to me 3306 setup in keep-state

add allow tcp from any to me 5432 setup in keep-state

add allow tcp from any to me 9008 setup in keep-state
add allow tcp from any to me 9080 setup in keep-state

add allow udp from any to me 137 in keep-state
add allow udp from any to me 138 in keep-state
add allow tcp from any to me 139 setup in keep-state
add allow tcp from any to me 445 setup in keep-state

add allow udp from any to me 1194 in keep-state

add allow udp from any to me 53 in keep-state
add allow tcp from any to me 53 setup in keep-state

add allow icmp from any to me icmptypes 8 in keep-state

add allow tcp from any to me setup in keep-state
add allow ip from any to me in keep-state

add allow tcp from me to any setup out keep-state
add allow ip from me to any out keep-state

add deny tcp from any to any setup
add deny ip from any to any

enable firewall
EOF
/sbin/sysctl net.inet.ip.fw.dyn_ack_lifetime=3600 >/dev/null
/sbin/sysctl net.inet.ip.forwarding=1 >/dev/null
echo 1 > /usr/local/psa/var/modules/firewall/ip_forward.active
chmod 644 /usr/local/psa/var/modules/firewall/ip_forward.active
#
# End of script
#