Today I am out-of-office and have to use my iPhone's tethering abilities to get my MacBook Pro online.

I have an online backup utility, CrashPlan, that immediately noticed that I had connectivity, and started backing up.

Since the data plan on my phone does not include unlimited data (at least not without having to pay extra per MB at some point), I stopped it immediately.

Is there a way for me to configure my MBP so that when I connect to the iPhone's WIFI hotspot, some applications are denied bandwidth, either built-in or through 3rd party applications?

  • You should look at ipfw. You can bind it to a specific interface (e.g., fw0). Then you can just set up a rule to block the traffic from CrashPlan (e.g., ipfw deny ip from {this is CrashPlan's IP is required; just ping them, you can set a range or a specific IP} to me in {you can bind it to a specific port or leave it blank and block it from your entire computer} via fw0 {this is the interface}). The only thing is you would just need your Mac to connect with a different interface. If not, you'd have to fire up ipfw manually before you tether. More on ipfw: bit.ly/kWLR0D – user10355 Nov 16 '11 at 8:56
  • Will ipfw settings change if I change my location? My MBP is never (well, extremely seldom) connected via a cable, but changing my location to be "Home" or "At the office" would be doable, if I could also create a location called "Mobile" that just shuts down unwanted bandwidth usage (with ipfw). I also have Waterroof installed, I assume I can use that to configure those rules? – Lasse V. Karlsen Nov 16 '11 at 9:07
  • ipfw binds to the interface you are using to push the bandwidth. So if you tether your phone via bluetooth (Bluetooth-Modem), you can set rules for just that interface. If you use ethernet, then en0. You can find the list using Network Utility. The only caveat is I'm not sure how the MBP reacts during a tether (what interface it uses). But if it uses something different (pretty likely), then you are home free. Bind the rules to that interface, and leave everything else alone. That'll just filter traffic only when you're tethered (or using that particular interface to push data). – user10355 Nov 16 '11 at 9:20
  • I added a firewall rule to deny all access to the ip/24 (isn't the /24 stating how much is "static"?) and from, the IP address I get when connected to my iPhone (found a reference which stated dhcp went from .2 to .14). This seems to work, of course this will prevent me from browsing to crashplan.com as well, but I can accept that. – Lasse V. Karlsen Nov 16 '11 at 9:20
  • Tethering uses the normal WIFI interface, but I have never seen the IP address range it uses anywhere else (on the networks I am on), so that's acceptable. – Lasse V. Karlsen Nov 16 '11 at 9:21

Use ipfw to bind a rule to your specific interface, blocking the site in question outright. For example, if CrashPlan's IP is, the rule would write as follows:

ipfw deny ip from to me in via en0

The "ip" tag blocks all traffic (tcp and udp, alternatively, you can set either or if you like). The IP address can be set to a range for more efficacy (e.g., The "me" tag is self-explanatory. Alternatively, you can actually set that up to a specific IP address too. So if your home network assigns you and tethering assigns you, then you can further ensure you only block the site when tethered, and not all the time. The "in" tag deals with direction of the traffic (in or out). And "via en0" deals with binding it to a specific interface.

You can also set ipfw to launch during boot, so you don't have to run this manually all the time. It's not a trivial process but does require some cli. Alternatively, you could check out WaterRoof. It's a free ipfw front-end that pretty much automates the entire thing. A terrific ipfw primer and setup assistant.

  • I configured it only for my IP address that I get from the iPhone, as I mentioned, it has a specific range. I also created a rc.local file and added all my ipfw commands in there, now it auto-configures as part of startup. – Lasse V. Karlsen Nov 16 '11 at 11:58

I haven't done this, but this the direction that I would explore: download Sidekick which is a utility that allows you to do all sorts of location based configuration. Setup a Location based on your iPhone's Hotspot and create an actions to turn Crashplan on and off via the command line.

Crashplan can be stopped via the command line with:

sudo launchctl unload /Library/LaunchDaemons/com.crashplan.engine.plist

and started with:

sudo launchctl load /Library/LaunchDaemons/com.crashplan.engine.plist

Not a direct solution for you, but Crashplan now offers a small menu bar app, that allows you to monitor the backup activity and easily manually pause backups.

  • 1
    I should have noted that this method has the advantage of not depending on knowing CrashPlan's IP address in advance. – Lee Joramo Nov 16 '11 at 21:24

CrashPlan now has a way to block specific wifi networks. http://support.code42.com/CrashPlan/Latest/Configuring/Network.

What I really want is the inverse: to allow only specific (trusted) wifi networks. And to ignore by default anything else, like airport and hotel wifi.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .