Securing FreeBSD

[G D McKee]

Hi all

I am trying to secure my freebsd box and avoid giving to much info away to port scans.

I have found some site relating to this and have put the following lines in /etc/sysctl.conf

net.inet.tcp.blackhole=2
net.inet.udp.blackhole=1

and added these to the firewall:

options         RANDOM_IP_ID
options         TCP_DROP_SYNFIN         #drop TCP packets with SYN+FIN

Can someone explain to me why the TCP_DROP_SYNFIN option breaks web access?  It doesn't seem to have made any changes that I have noticed.  I can't find any docs regarding this to explain what it might break.  Does anyone know any other variables to add to make me more secure?

Thanks in advance

Gordon