So i can add an anchor to the already enabled firewall by doing something like this:

$ pfctl -a anchor_name -f /etc/anchor_rules.txt

the file "anchor_rules.txt" might contain something like this:

table <some-hosts> persist file /etc/someHostsToBlock.txt
block quick from any to some-hosts

Now, i can see the rules inside the anchor by doing this:

$ pfctl -a anchor_name -sr
No ALTQ support in kernel
ALTQ related functions disabled
block drop quick from any to some-hosts

However, when i show the current active ruleset with:

$ pfctl -sr
No ALTQ support in kernel
ALTQ related functions disabled
scrub-anchor "com.apple/*" all fragment reassemble
anchor "com.apple/*" all

i don't see the anchor called "anchor_name" which i just added. So the anchor is not actually active/loaded...

Why not, and how to load it?

2 Answers 2


In my understanding of pf your major anchor is missing. You may either use Apple's anchor(s) or a user defined anchor.

A user defined anchor is preferred:

  1. Modify /private/etc/pf.conf:

    Add two lines to pf.conf like this:

    load anchor "com.apple" from "/etc/pf.anchors/com.apple"
    # usr.home anchor point
    anchor "usr.home/*"
    load anchor "usr.home" from "/etc/pf.anchors/usr.home"
  2. Create a file usr.home. In the example below I create an anchor SSH blocking SSH access from a local network to some IPs of the host:

    sudo nano /etc/pf.anchors/usr.home

    and add

    # usr.home ruleset, referred to by the modified /etc/pf.conf file.
    # See notes in that file regarding the anchor point in the main ruleset.
    # SSH anchor point.
    anchor "SSH"
    load anchor "SSH" from "/etc/pf.rules/pfssh.rule"
  3. Now create a new directory

    sudo mkdir /etc/pf.rules

    and the referenced file with:

    sudo nano /etc/pf.rules/pfssh.rule

    and the following content:

    block in quick inet proto { tcp, udp } from to {, } port 22
  4. Parse and test your pf.conf and your anchor file to make sure that they are error-free:

    sudo pfctl -vnf /etc/pf.conf
    sudo pfctl -vnf /etc/pf.anchors/usr.home
  5. Reload pf:

    sudo pfctl -d
    sudo pfctl -e -f /etc/pf.conf

You can add additional anchors to your major usr.home anchor as demontrated in the major com.apple anchor.

You can also add additional dynamic sub-anchors with the following command (here I add a temporary block HTTP rule similar to the SSH rule - check the creation of a transitory sub-anchor: usr.home/HTTP here!):

echo "block drop in quick proto tcp from to any port 80" | sudo pfctl -a usr.home/HTTP -f -

The temporary anchor doesn't survive a reboot!

One possible command to remove the temporary rule immediately is:

echo "" | sudo pfctl -a usr.home/HTTP -f -

A handy script to check all loaded anchors and rules is pfdump:



function pfprint() {
  if [ -n "$1" ];then
    sudo pfctl -a "$2" -s"$1" 2>/dev/null
    sudo pfctl -s"$1" 2>/dev/null

function print_all() {

  local p=$(printf "%-40s" $1)
    pfprint r "$1" | sed "s,^,r     ,"
    pfprint n "$1" | sed "s,^,n     ,"
    pfprint A "$1" | sed "s,^,A     ,"
  ) | sed "s,^,$p,"

  for a in `pfprint A "$1"`; do
    print_all "$a"


All files mentioned require an empty new line at the end!

  • 1
    something to be aware of... it seems pfdump.sh does NOT list the output / anchors in the ORDER they will be evaluated. So you could say it outputs things in the wrong order - which has effect on the result.
    – Motsel
    Jan 21, 2018 at 22:05
  • If you modify /private/etc/pf.conf directly will these changes survive across OS upgrades?
    – Tom
    Jun 11, 2019 at 19:16
  • @Tom I’m not 100% certain, but I believe that merge-able changes to /etc/pf.conf will be preserved. However, I can state with certainty that changes to /etc/pf.anchors/com.apple, will not be preserved. Beware any guides or scripts that involve modifying that file.
    – macserv
    Jun 12, 2019 at 16:46
  • 1
    @macserv aren't you supposed to create a user-level anchor and a launchd plist that tells pfctl to enable that anchor? this seems more maintainable than to edit system level files (altho I personally never got it to work with anchors..)
    – Tom
    Jun 12, 2019 at 20:03

Took me a while to find out how it seems to work without modifying system files. An official documentation how to properly use pf on macOS would be great, but I couldn't find any.

First, to show all anchors, you have to use sudo pfctl -vsA.

Your "anchor_rules.txt" seems to be wrong. I have placed mine under "/etc/pf.anchors/block". At least under macOS 12.0.1 I have get erros with sudo pfctl -vnf /etc/pf.anchors/block. The working rules looks like the following. But I'm not sure, if it does what you think it does.

table <some-hosts> persist file "/etc/someHostsToBlock.txt"
block quick from any to <some-hosts>

To load the anchor and enable pf you have to use sudo pfctl -a 'com.apple/block' -f /etc/pf.anchors/block -e.

To start pf and load your custom anchor on system boot, you have to use launchd.


<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">

sudo launchctl load /Library/LaunchDaemons/block.pfctl.plist

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .