How does one lock down OS X Server using the PF firewall?
You should:


understand pf basics - here is many guides on the Internet, you can safely read any Open/Free BSD guide. You must understand a few basic things:


with PF, last rule wins (opposite of IPFW's "first rule wins")
logging is in the pflog device if the 'tcpdump' format
check the pfctl command using man pfctl
also check man pf.conf
you can create many simple text files that contains IP addresses (called tables) and using them in the filtering rules - see the example below.

AFTER this you can use two GUI frontends


IceFloor (instead of the WaterRoof)
Firewall builder (cross platform)



PF is not too hard if you have some knowledge about how firewalling works in general.

Fragment of pf.conf for table based filtering:

interface = "en0"
allowed_ports = "{ 80, 443 }"
table &lt;badips&gt; persist
table &lt;noroute&gt; const { 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8 }
block in on $interface from { &lt;noroute&gt;, &lt;badips&gt; } to any
pass in on $interface inet proto tcp from &lt;badips&gt; to $interface port $allowed_ports


The above example contains:


some basic definitions, like your interface name and some ports
definition for two tables, noroute for nonroutable addresses (RFC 1918) and the second badips that can contain your Geo IP based IP addresses 
filtering rule - blocking anything from these tables
allowing ports 80 and 443 from badips (last rule wins)