1

I would like to use VPN domain names instead of IP addresses to only allow some VPN servers on my Mac. I did everything here to set up pfctl to only allow some VPN servers to open access to some specific IP addresses however, I don't know how to add host names instead IP addresses to my allowed VPN list.

Because the IP addresses changes but host names not, is it possible to add host names instead IP addresses to pfctl?

1

You can simply add the host names instead of IPs to the tables. If DNS resolution isn't blocked they will be resolved.

I recommend to include the tables in /etc/pf.anchors/org.vpnonly.pf.rules

...
# Ports
allowed_vpn_ports = "{ 1:65535 }"

# Table with allowed IPs
table <allowed_vpn_ips> const { us1.vpnprovider.com, us2.vpnprovider.com, uk.vpnprovider.com }
table <allowed_dns_ips> const { 8.8.8.8, 8.8.4.4 }

# Block all outgoing packets
block out all
...

Test this with sudo pfctl -vnf /etc/pf.conf.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .