pf is packet filter for *BSD.
Here is a sample ruleset that does nothing much except block one IP address to the web server on port 80.
ext_if="em0" # replace with actual external interface name i.e., dc0 int_if="em1" # replace with actual internal interface name i.e., dc1 internal_net="192.168.1/24" scrub in all pass in all pass out all block in quick on $ext_if proto tcp from 126.96.36.199/32 to any port 80
Start pf with the ruleset above (in /etc/pf.conf)
pf -F -f /etc/pf.conf
On FreeBSD you can use the rc script, assumes proper settings in /etc/rc.conf
View the ruleset matches
pfctl -v -s rules