I found what appears to be a suitable guide here, but pfctl complains of a syntax error and "no IP address found for en3" which is my main interface. I have had other pf rules working successfully to forward ports, etc. but I cannot figure this out.

I am on 10.11.4 and using Tunnelblick connected to a OpenVPN server i installed myself on a VPS.

Could someone give instructions on the correct configuration for pfctl on El Capitan? I need to keep open access to private networks like and



The following works on Sierra.

Append the following lines to the end of /etc/pf.conf

anchor "org.vpnonly.pf"
load anchor "org.vpnonly.pf" from "/etc/pf.anchors/org.vpnonly.pf.rules"

Create this configuration file at /etc/pf.anchors/org.vpnonly.pf.rules

# Options
set block-policy drop
set fingerprints "/etc/pf.os"
set ruleset-optimization basic
set skip on lo0

# Interfaces
vpn_intf = "{ utun0 utun1 utun2 utun3 }"

# Ports
allowed_vpn_ports = "{ 1:65535 }"

# Table with allowed IPs
table <allowed_vpn_ips> persist file "/etc/pf.anchors/vpn.list" file "/etc/pf.anchors/custom.list"

# Block all outgoing packets
block out all

# Antispoof protection
#had to disable this to avoid error
#antispoof for $vpn_intf inet

# Allow outgoing packets to specified IPs only
pass out proto icmp from any to <allowed_vpn_ips>
pass out proto {tcp udp} from any to <allowed_vpn_ips> port $allowed_vpn_ports

# Allow traffic for VPN interfaces
pass out on $vpn_intf all

Create /etc/pf.anchors/vpn.list and /etc/pf.anchors/custom.list

sudo touch /etc/pf.anchors/vpn.list /etc/pf.anchors/custom.list

Add a list of allowed IP addresses (addresses of VPN servers) to /etc/pf.anchors/vpn.list


Add google DNS to custom /etc/pf.anchors/custom.list

sudo pfctl -e -f /etc/pf.conf and check for errors

To load at startup, edit to default pfctl at /System/Library/LaunchDaemons/com.apple.pfctl.plist to set <key>Disabled</key> <true/>

ensure rootless mode is disabled. (boot to recovery terminal with Command+R at the chime and run csrutil disable run these commands, then return to recovery terminal afterwards to reenable rootless with csrutil enable

Create your LaunchDaemon at /Library/LaunchDaemons/com.apple.pfctl.plist

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">

finish with sudo chmod 644 /Library/LaunchDaemons/com.apple.pfctl.plist, reboot with rootless mode enabled and you're set.

  • I always wanted to answer this question - I have an open tab with this question for 2 months now - but failed to setup a properly working OpenVPN server at AWS. Good to see that it is answered now. – klanomath Oct 29 '16 at 16:01
  • Do you really have to edit /etc/pf.conf as root? this seems so broken. In linux/windows you can just add new firewalls rules by calling iptables or wfp code -- is there really no way to do this in osx without editing a frikkin config file as root? – horseyguy Jun 5 '18 at 23:46
  • the file is owned by root: -rw-r--r-- 1 root wheel 1.0K 16 Jul 2017 /etc/pf.conf it may be possible to create a user owned config file as well. i have not tried. – jakethedog Jun 7 '18 at 0:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .