6

I am looking for a pretty elegant way to launch the pf - a.k.a. Packet Filtering - process at startup. Using the launchctl or the pfctl commands, root privileges are required and so it is useless to add them into .bash_profile. Are there alternative solutions to this issue?

  • Can you explain what you're actually trying to accomplish? Pf might not even be the best way. – Harv Dec 8 '17 at 8:56
  • @Harv I’d like to block the outgoing connections that some applications establish on launch. – rudicangiotti Dec 9 '17 at 2:05
  • Check this out: hanynet.com/pflists/index.html, I'm guessing you ruled out Radio Silence, Little Snitch etc? – Harv Dec 9 '17 at 4:33
  • @Harv yes, because they are not free applications. pflist, on its side, is an open source project but seems to be not fully compatible with macOS Sierra - which I’m currently using - and next versions. Furthermore, it is nothing but an user-friendly interface of pf. – rudicangiotti Dec 10 '17 at 14:10
6

By default pf is silenced at startup, a launch daemon com.apple.pfctl.plist exists though in /System/Library/LaunchDaemons/. To enable pf while booting you would have to add an -e switch in the plist.

Since all files in /System/Library/LaunchDaemons/ are protected by SIP in macOS 10.11 and later you have to disable it first.

Then, after booting to the main system, edit the launch daemon plist:

sudo nano /System/Library/LaunchDaemons/com.apple.pfctl.plist

and replace

  ...
  <key>ProgramArguments</key>
  <array>
    <string>/sbin/pfctl</string>
    <string>-f</string>
    <string>/etc/pf.conf</string>
  </array>
  ...

with

  ...
  <key>ProgramArguments</key>
  <array>
    <string>/sbin/pfctl</string>
    <string>-e</string>
    <string>-f</string>
    <string>/etc/pf.conf</string>
  </array>
  ...

Reboot to Recovery Mode and enable SIP again.

  • My friend, this is indeed the best method, and I endorse your answer. – Francis from ResponseBase Sep 29 '18 at 9:40
  • I don’t think it’s safe to edit system files like this. Your changes may not survive OS upgrades. Shouldn’t you create a launchctl job on a user level? – Tom Jun 11 at 22:16
4

It is possible to launch processes at startup using daemons. You can create a daemon - or even edit an already existing one - respectively adding or modifying a .plist file inside /System/Library/LaunchDaemons or /Library/LaunchDaemons.
In my case, running macOS Sierra, a daemon for pfctl was already located inside one of those folders but it was set up without the -e option; consequently, at startup the daemon was launched without any effect.
The issue has been solved adding that mentioned option, plus something more despite it is not properly necessary:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Disabled</key>
  <false/>
  <key>Label</key>
  <string>com.apple.pfctl</string>
  <key>WorkingDirectory</key>
  <string>/var/run</string>
  <key>Program</key>
  <string>/sbin/pfctl</string>
  <key>ProgramArguments</key>
  <array>
    <string>/sbin/pfctl</string>
    <string>-e</string>
    <string>-f</string>
    <string>/etc/pf.conf</string>
  </array>
  <key>RunAtLoad</key>
  <true/>
  <key>StandardErrorPath</key>
  <string>/var/log/pfctl.err</string>
  <key>StandardOutPath</key>
  <string>/var/log/pfctl.out</string>
</dict>
</plist>
0

Are there alternative solutions to this issue?

Yes*, in System Preferences / Security & Privacy / Firewall Options..., check "Enable stealth mode" and turn on Firewall.

Somehow this enables PF. You can check by running sudo pfctl -s info.

*Tested on High Sierra and Mojave

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .