I have been trying to make a change (for port forwarding/redirecting) to the pfctl.conf file and have it ( the /etc/pfctl.conf file) loaded at startup. The pfctl.conf has been been confirmed to be working as expected because issuing sudo pfctl -ef /etc/pfctl.conf leads to the desired behavior (requests to one port get forwarded to the other).

That pfctl itself is actually loaded at startup is also confirmed because doing launchctl list | grep pf shows com.apple.pfctl in the output. However, the desired forwarding behavior is not achieved directly after startup. It happens only on doing pfctl -f /etc/pfctl.conf after startup. Oddly enough, the output of pfctl -ef /etc/pfctl.conf still says pf already enabled.

Therefore, I concluded that while pf is loaded at startup, the daemon seems to not load from the conf file. The body of the launch daemon com.apple.pfctl.plist now looks like:

<plist version="1.0">

Having checked the discussion at Getting launchd to read program arguments correctly it was informative but not practically helpful in this instance - I have already tried editing the program arguments of the plist file to include the full path to the pfctl executable (as can be seen in the code above - first line of the arguments array) but to no avail. I have also added an argument (second line of arguments array) to actually launch pfctl based on the discussion at this gist. The daemon also seems to be configured correctly according to the instructions at Apple developer docs. In accordance to the developer docs (which state that the program tag is required when the program arguments are not supplied and vice versa), I also tried removing the program tag while leaving the program arguments array in place (with the path to the executable as the first argument) - but this had no effect either.

Puzzlingly, the shipped version of the pfctl.plist file (which can be assumed to be most likely correct) had both the program tag and the program arguments tag, apparently in contradiction to the dev docs (or maybe I misunderstood the docs).

So now I am completely at a loss. Any help would be most appreciated!

Additional info: Not sure this is relevant, but just in case it is: the anchor file (created by me) which is referenced by pf.conf looks like:

rdr pass on lo0 inet proto tcp from any to port =80 -> port 8888  

So is there a possibility that the network interface is not yet active and addresses have not been assigned at the time the daemon runs? If so, how can it be fixed?

  • Looks to me like you have the path to pfctl twice in there. Remove the one from program arguments? Jul 3, 2016 at 18:23
  • Yes, in this snippet, that is indeed the case. The default (stock version) was indeed what you said - remove it from the program arguments. Since it didn't work, I tried adding it to the arguments after reading the (linked) manual. However, I have also tried having the full path in the program arguments tag but not in the program tag (removed the program tag entirely). None of the combinations worked sadly.
    – ahron
    Jul 4, 2016 at 0:50
  • Did you try putting it all in the program tag and just leaving the whole arguments dict out of it? Also, when it's running, how does ps wwaux look? Jul 4, 2016 at 3:04

1 Answer 1


Try removing the Program argument:


A deep explanation is found here: https://akikoskinen.info/launch-daemon-agent-program-programarguments/

  • That's not what the linked article says to do. You might want to double check that link.
    – Allan
    Nov 8, 2020 at 22:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .