Control packets with pfctl

Question

Looking for a way to control precisely which process or application is allowed to communicate with the network in a low connectivity context, I found the pfctl command which seems to be designed for the job.

I would like to allow only a few applications to connect to the network (ie: ping and Mail) and remove Apple unnecessary services.

Here is my current /etc/pf.conf file:

scrub-anchor "com.apple/*"
nat-anchor "com.apple/*"
rdr-anchor "com.apple/*"
dummynet-anchor "com.apple/*"
anchor "com.apple/*"
load anchor "com.apple" from "/etc/pf.anchors/com.apple"

I try to understand the pfctl status with this command:

$ sudo pfctl -sr
No ALTQ support in kernel
ALTQ related functions disabled
scrub-anchor "com.apple/*" all fragment reassemble
anchor "com.apple/*" all

Is it possible to achieve the filtering I want with pfctl and how?

Answer 1

PF (Packet Filter which command line interface of is pfctl) can't do this, because it's not application but port/interface based. You may block port 80/443 for a web browser (like Safari) but this will also block Mail fetching an web-based embedded picture in an email.

Your best bet is to use a host-based application firewall like Little Snitch. The app allows a fine-grained control of outgoing traffic. You may even allow a browser to connect to text based (low traffic) websites while blocking all other sites.

You can even set up several profiles for low- or high-bandwidth locations.