I am trying to forward all ports except port 22 on OSX Sierra using pfctl but it doesn't seem to work.

file: /pf.conf

ext_if = "inet"
rdr pass $ext_if proto tcp from any to any -> port 12345
rdr pass $ext_if proto udp from any to any -> port 10053
pass out proto tcp from any to any port ssh

I enabled it with

sudo sysctl -w net.inet.ip.forwarding=1
sudo pfctl -f pf.conf
sudo pfctl -e

The traffic seems to be redirecting fine to port 12345, but I can't get port 22 to passthrough.

1 Answer 1


The ssh line should be above the ‘rdr’ lines, so that the ssh line is matched first.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .