How do I use pf/IceFloor to block an outgoing connection to an IP address?

Question

I am running an application that regularly phones home and reports a little more information than I'm comfortable with. I would normally add the reporting server's hostname to /etc/hosts, but the app does not perform a DNS lookup and connects directly by IP. I am looking to use Lion's built in PF firewall to achieve this.

I understand that a commercial utility like LittleSnitch would make this a trivial endeavor. However, this is not a viable solution for me. I find their asking price too high, and the built in firewall should be able to do the trick.

I've been using IceFloor to modify the PF configuration to block incoming connections with great success. However, I'm running into some problems blocking outgoing connections. From what I've read, the following rule should be correct:

block return-rst out quick on en0 inet proto tcp from any to xxx.xxx.230.191

It should block only TCP packets to that IP and reply with a RST packet. It seems to be blocking the packets properly, but instead of returning an RST packet, it is silently dropping the outgoing packets. This is causing the app to hang while it waits for the connection attempt to timeout.

Is this rule written correctly to achieve what I would like to achieve? Has anyone else attempted something like this using PF?

Answer 1

My friend, if memory serves me well, you will need to add

net.inet.tcp.icmp_may_rst=0

to /etc/sysctl.conf, and then modify the running kernel-

sudo sysctl -w net.inet.tcp.icmp_may_rst=0

That should do the trick. If no /etc/sysctl.conf exists, here is a shortcut:

sudo echo “net.inet.tcp.icmp_may_rst=0” >> /etc/sysctl.conf
sudo chmod 644 /etc/sysctl.conf

Hope that resolves the inconsistency with PF.

F.