I have an app that (while it is running and only while it is running) needs to make changes to the packet filter (pf
) so that it blocks or allows certain traffic. These rules should be in addition to the user's own rules in /etc/pf.conf
- but i do not want to directly edit /etc/pf.conf
as this is extremely intrusive.
I can do this trivially in linux using iptables
and even in windows using wfp
without altering any on-disk files, can i accomplish the same thing in osx with pf
?
Solution only has to work in yosemite
(10.10) and above
cat /etc/pf.conf my_rules.conf | sudo /sbin/pfctl -Ef -
The-
arg topfctl
causes it to read from stdin, so we just concat pf.conf with our own rules to get it to read from both, but to ensure our rules take precedence (that's why our rules are concatenated last)pfctl
with difference configuration that override yours? I can do periodical check with the currently applied rules, but I wish I could get notification right when it changes... any idea how ?