2

I have an app that (while it is running and only while it is running) needs to make changes to the packet filter (pf) so that it blocks or allows certain traffic. These rules should be in addition to the user's own rules in /etc/pf.conf - but i do not want to directly edit /etc/pf.conf as this is extremely intrusive.

I can do this trivially in linux using iptables and even in windows using wfp without altering any on-disk files, can i accomplish the same thing in osx with pf ?

Solution only has to work in yosemite (10.10) and above

4
  • Hi, I wonder if you have found a way to achieve this goal by now ... I'm struggling with the same scenario. if you did, please share :-) thanks
    – Zohar81
    Oct 4, 2018 at 6:22
  • 1
    @Zohar81sure i figured it out, do this: cat /etc/pf.conf my_rules.conf | sudo /sbin/pfctl -Ef - The - arg to pfctl causes it to read from stdin, so we just concat pf.conf with our own rules to get it to read from both, but to ensure our rules take precedence (that's why our rules are concatenated last)
    – horseyguy
    Oct 4, 2018 at 8:10
  • @Zohar81 also see my answer below
    – horseyguy
    Oct 4, 2018 at 8:22
  • Perhaps are you also familiar of an option to get notification if some other root process call pfctl with difference configuration that override yours? I can do periodical check with the currently applied rules, but I wish I could get notification right when it changes... any idea how ?
    – Zohar81
    Oct 10, 2018 at 6:57

2 Answers 2

5

I solved this myself.

cat /etc/pf.conf my_rules.conf | sudo /sbin/pfctl -Ef -

Where my_rules.conf contains our own rules, these get concatenated to the pf.conf rules but take precedence due to them being appended after pf.conf in the cat command.

Also note we use pfctl -Ef - the - forces pfctl to read from stdin

We can take this solution a step further and load our own rules from stdin by using this:

echo "block out all" | cat /etc/pf.conf - | sudo /sbin/pfctl -Ef -
1
  • What does the -E does? The man pfctl doc is not very clear: it says that it enables the filtering like -e but it also says: "(...) and increment the pf enable reference count." and I did not get what this is exactly.
    – VinGarcia
    Aug 12, 2022 at 12:57
1

It depends on the type of application and programming language. The true programmatically way would be to open /dev/pf and use ioctl. I haven't done this myself, but the following links should be helpful.

If calling pfctl from the app is sufficient, then I would still use anchors.

Without a file: echo "block out all" | sudo /sbin/pfctl -a 'com.apple/app_name' -f -

With a file: sudo /sbin/pfctl -a 'com.apple/app_name' -f /path/to/file

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .