2

I have to forward every internet page to my local address i.e. 127.0.0.1 using OS X.

I tried following command but it has no effect:

echo " rdr pass inet proto tcp from any to any port 80 -> 127.0.0.1 port 8080 " | sudo pfctl -ef -

I have tried to research the exact meaning of the above line but I can't find a good explanation. How do I perform this forwarding?

Edit 1:

Let's say a user enters "www.google.com" in the browser; this should have an impact like this -->

User should be redirected to my local page which is at 127.0.0.1:8080

Now, if I hit 127.0.0.1:8080 I do see my local portal.

But, I want it to be shown after redirection from "Google.com"

I am writing following statement. But, they are not having any effect.

rdr pass on lo0 proto {tcp, udp} from any to any port 80 -> 127.0.0.1 port 7894 
pass out log(all) on em0 route-to lo0 inet proto {tcp, udp} from any to any port 80 keep state

I am writing above lines in my anchor file and adding anchor to pf.conf using rdr-anchor

  • 2
    What exactly are you trying to achieve? – techraf Mar 12 '16 at 12:54
  • Have you read the manual page for pf.conf(5) and pfctl(8)? – user3439894 Mar 12 '16 at 14:36
  • @techraf, I want redirect a specific page lets say 'www.google.com' to my local page i.e. 127.0.0.1:8080 which can be served as local Google.com. If we could redirect every page to my local portal then also it is fine – PrafulD Mar 12 '16 at 14:40
  • 1
    google.com will immediately redirect you to https and bypass your redirection, if you configure redirection for port 443, you will get a certificate error in the browser. Is that what you are trying to achieve? – techraf Mar 12 '16 at 15:39
  • @PrafulD You still don't understand the part "to any". "Any" doesn't mean all IP addresses of the whole world but all IP addresses of the local machine. So Google's IP address (e.g. 216.58.201.206) is not included in the to any in "from any to any port 80"! The to any means all IP addresses of the local (destination/web)-server (which may be en0 (ethernet): 192.168.0.3/10.12.24.3, en1 (wifi): 192.168.1.3 etc.) – klanomath Mar 22 '16 at 11:54
1

If I understand your question and your comment correctly you are trying to achieve something like a local captive portal.

This can't be done with pf and a simple redirect. A lot more stuff and configuration is involved. Here (the link to bsdguides.org in the github readme doesn't work: correct link) you find an example how to do this in OpenBSD. The solution there may be adapted to OS X under certain circumstances.


The rule rdr pass inet proto tcp from any to any port 80 -> 127.0.0.1 port 8080 does the following:

rdr pass inet proto tcp from any to any port 80 -> 127.0.0.1 port 8080
|   |    |              |
|   |    |              #from any IP (all source IPs) to any IP (all destination IPs of the local machine)
|   |    |              from any to any
|   |    #IPv4 Protocol TCP
|   |    inet proto tcp
|   #allow
|   pass
#redirect from port 80 to localhost:8080
rdr                                     port 80 -> 127.0.0.1 port 8080

Or: any incoming (rdr only redirects incoming packets) IPv4 TCP traffic (on any interface) to port 80 from any IP to any IP (on any interface) of the local machine is passed and redirected to 127.0.0.1:8080.

The rule doesn't redirect requests from a local client machine for google.com:80 (i.e. 216.58.201.206:80) or 175.68.9.102:80 to 127.0.0.1:80 because neither of these IPs is an IP of the local (www-)server machine nor does the local (www-)server know of the requests.

This doesn't apply to outgoing traffic of the local machine because that's no incoming traffic. You have to loop this traffic first:

  • I have added following two lines to my pf.anchor file rdr pass on lo0 proto {tcp, udp} from any to any port 80 -> 127.0.0.1 port 7894 pass out log(all) on em0 route-to lo0 inet proto {tcp, udp} from any to any port 80 keep state But its not working – PrafulD Mar 19 '16 at 14:31
  • @PrafulD Please add the content of your comment to your question and explain exactly what you want to achieve. The latter is still unclear! – klanomath Mar 19 '16 at 16:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .