Trying to open a http website on any web browser (event telnet) gives a ‘ERR_CONNECTION_REFUSED’ or ‘connection timed out’.
However, the same sites can be opened using https. I tried doing a traceroute and it works fine.
I am new to OS X but have experience with Linux. How do I go about troubleshooting this issue?
I think I've tracked down the culprit to a rule in pf (firewall).
The result of
sudo pfctl -s nat is:
No ALTQ support in kernel
ALTQ related functions disabled
rdr pass inet proto tcp from 192.168.0.101 to any port = 80 -> 127.0.0.1 port 9882
192.168.0.101 is the current ip address of the computer.
I tried to remove the rule with
sudo pfctl -F all, but it is back after a few seconds. I didn't find the rule in the default configurations (
/etc/pf.conf). And disabling pf with
sudo pfctl -d has no effect on it.
Is this a malware issue?