Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

I am running an application that regularly phones home and reports a little more information than I'm comfortable with. I would normally add the reporting server's hostname to /etc/hosts, but the app does not perform a DNS lookup and connects directly by IP. I am looking to use Lion's built in PF firewall to achieve this.

I understand that a commercial utility like LittleSnitch would make this a trivial endeavor. However, this is not a viable solution for me. I find their asking price too high, and the built in firewall should be able to do the trick.

I've been using IceFloor to modify the PF configuration to block incoming connections with great success. However, I'm running into some problems blocking outgoing connections. From what I've read, the following rule should be correct:

block return-rst out quick on en0 inet proto tcp from any to xxx.xxx.230.191

It should block only TCP packets to that IP and reply with a RST packet. It seems to be blocking the packets properly, but instead of returning an RST packet, it is silently dropping the outgoing packets. This is causing the app to hang while it waits for the connection attempt to timeout.

Is this rule written correctly to achieve what I would like to achieve? Has anyone else attempted something like this using PF?

share|improve this question
1  
You may be able to setup a dead preferred route for the IP (random thought). see man route. make all connections to the specific IP try to route through the lo interface. –  Fake Name May 13 '12 at 5:09

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.