Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

I have a machine. I want to configure it so that it can only talk to 192.168.1.1 (gitserver) and 127.0.0.1 (localhost).

This machine is meant to be pure work, no distractions.

I'm on OS X Lion.

I'm familiar with iptables on Linux, but not sure how to configure this (or if it's even possible).

What do I need to read up to make this work?

PS: configuring the router is not an option; it's some simple $30 router.

share|improve this question

migrated from stackoverflow.com Jul 9 '12 at 14:58

This question came from our site for professional and enthusiast programmers.

1  
download little snitch and set two rules to allow the ip addresses you want, and one rule to deny everything else –  Billy Moon Jul 9 '12 at 4:26
    
Would an extra router be an option? –  Thorbjørn Ravn Andersen Aug 22 '12 at 16:48
    
Pleas state the router model. Most $30 routers I know still have this via an admin interface for free. If it was a switch, forget it, they can't be programmed, but routers often can. Any info on the bottom (underneath)? –  Michael Durrant Aug 26 '12 at 12:46

2 Answers 2

up vote 5 down vote accepted

Mac OS X like other BSD systems uses ipfw instead of iptables. Read the man page for full reference.

One way to would be to deny all TCP "establish connection" packets except those directed to gitserver, leaving all other traffic untouched:

ipfw add allow tcp from me to gitserver setup
ipfw add allow tcp from me to me setup # may not be needed
ipfw add deny tcp from any to any setup

The rules will be lost on reboot, so they must be set on every boot (e.g. from /etc/rc.common or crontab's @reboot).

If that seems too complicated, get a third party firewall. Little Snitch is a good one, but it costs another $30 :)

share|improve this answer

A little outside-the-box thought: Put a second network card into gitserver and connect the machine via that. Of course, routing should be disabled on gitserver.

Alternatively, assign your machine the IP 192.168.1.2, netmask 255.255.255.252 and leave the "router" field empty. This basically means your machine can communicate directly only with 192.168.1.1 and if there is no router configured, it doesn't know how to reach the outside world.

For both of these approaches, you need to be sure you don't need anything from "outside" - DNS, NTP, AppStore and application updates via network will not work with those setups.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.