Port forwarding in OS X 10.10

Question

I have to forward every internet page to my local address i.e. 127.0.0.1 using OS X.

I tried following command but it has no effect:

echo " rdr pass inet proto tcp from any to any port 80 -> 127.0.0.1 port 8080 " | sudo pfctl -ef -

I have tried to research the exact meaning of the above line but I can't find a good explanation. How do I perform this forwarding?

Edit 1:

Let's say a user enters "www.google.com" in the browser; this should have an impact like this -->

User should be redirected to my local page which is at 127.0.0.1:8080

Now, if I hit 127.0.0.1:8080 I do see my local portal.

But, I want it to be shown after redirection from "Google.com"

I am writing following statement. But, they are not having any effect.

rdr pass on lo0 proto {tcp, udp} from any to any port 80 -> 127.0.0.1 port 7894 
pass out log(all) on em0 route-to lo0 inet proto {tcp, udp} from any to any port 80 keep state

I am writing above lines in my anchor file and adding anchor to pf.conf using rdr-anchor

Answer 1

If I understand your question and your comment correctly you are trying to achieve something like a local captive portal.

This can't be done with pf and a simple redirect. A lot more stuff and configuration is involved. Here (the link to bsdguides.org in the github readme doesn't work: correct link) you find an example how to do this in OpenBSD. The solution there may be adapted to OS X under certain circumstances.

---

The rule rdr pass inet proto tcp from any to any port 80 -> 127.0.0.1 port 8080 does the following:

rdr pass inet proto tcp from any to any port 80 -> 127.0.0.1 port 8080
|   |    |              |
|   |    |              #from any IP (all source IPs) to any IP (all destination IPs of the local machine)
|   |    |              from any to any
|   |    #IPv4 Protocol TCP
|   |    inet proto tcp
|   #allow
|   pass
#redirect from port 80 to localhost:8080
rdr                                     port 80 -> 127.0.0.1 port 8080

Or: any incoming (rdr only redirects incoming packets) IPv4 TCP traffic (on any interface) to port 80 from any IP to any IP (on any interface) of the local machine is passed and redirected to 127.0.0.1:8080.

The rule doesn't redirect requests from a local client machine for google.com:80 (i.e. 216.58.201.206:80) or 175.68.9.102:80 to 127.0.0.1:80 because neither of these IPs is an IP of the local (www-)server machine nor does the local (www-)server know of the requests.

This doesn't apply to outgoing traffic of the local machine because that's no incoming traffic. You have to loop this traffic first:

• pf (Mac OS X) rule to redirect all traffic to a specific ip/port
• OS X 10.8: redirecting locally initiated ssh connections to localhost:22