0

The firewall is on. I blocked IP 93.184.220.29 with PF but it still popsup in netstat -n. How is that possible?

jen:~ jen$ sudo pfctl -t blockedips -T show
Password:
No ALTQ support in kernel
ALTQ related functions disabled
   93.184.220.29

Output of

netstat -n

tcp4       0      0  192.168.2.4.51402      93.184.220.29.80       ESTABLISHED
tcp4       0      0  192.168.2.4.51401      93.184.220.29.80       ESTABLISHED

Output of

 sudo pfctl -s all
Password:
No ALTQ support in kernel
ALTQ related functions disabled
TRANSLATION RULES:
nat-anchor "com.apple/*" all
rdr-anchor "com.apple/*" all

FILTER RULES:
scrub-anchor "com.apple/*" all fragment reassemble
anchor "com.apple/*" all
block drop quick on ALL proto tcp from any to any port = 80
block drop quick on ALL proto udp from any to any port = 80

DUMMYNET RULES:
dummynet-anchor "com.apple/*" all

Output of:

sudo pfctl -vvv -s all
Password:
No ALTQ support in kernel
ALTQ related functions disabled
TRANSLATION RULES:
@0 nat-anchor "com.apple/*" all
  [ Owner : nil          Priority : 0     ]
  [ Evaluations: 179894    Packets: 0         Bytes: 0           States: 0     ]
  [ Inserted: uid 0 pid 68 ]
@0 rdr-anchor "com.apple/*" all
  [ Owner : nil          Priority : 0     ]
  [ Evaluations: 574091    Packets: 0         Bytes: 0           States: 0     ]
  [ Inserted: uid 0 pid 68 ]

FILTER RULES:
@0 scrub-anchor "com.apple/*" all fragment reassemble
  [ Owner : nil          Priority : 0     ]
  [ Evaluations: 1133714   Packets: 0         Bytes: 0           States: 0     ]
  [ Inserted: uid 0 pid 68 ]
@0 anchor "com.apple/*" all
  [ Owner : nil          Priority : 0     ]
  [ Evaluations: 574091    Packets: 0         Bytes: 0           States: 0     ]
  [ Inserted: uid 0 pid 68 ]
@1 block drop inet from any to 93.184.220.29
  [ Owner : nil          Priority : 0     ]
  [ Evaluations: 574091    Packets: 812       Bytes: 51968       States: 0     ]
  [ Inserted: uid 0 pid 68 ]
@2 block drop inet from any to 93.184.220.70
  [ Owner : nil          Priority : 0     ]
  [ Evaluations: 573678    Packets: 210       Bytes: 13152       States: 0     ]
  [ Inserted: uid 0 pid 68 ]
@3 block drop quick on ALL proto tcp from any to any port = 80
  [ Owner : nil          Priority : 0     ]
  [ Evaluations: 574091    Packets: 0         Bytes: 0           States: 0     ]
  [ Inserted: uid 0 pid 68 ]
@4 block drop quick on ALL proto tcp from any to any port = 53
  [ Owner : nil          Priority : 0     ]
  [ Evaluations: 0         Packets: 0         Bytes: 0           States: 0     ]
  [ Inserted: uid 0 pid 68 ]
  • The table blockedips doesn't seem to be blocking that IP address, which is the output of sudo pfctl -s all ? – jaume Aug 29 '18 at 13:01
  • I edited and added the output of sudo pfctl -s all – jennifer ruurs Aug 29 '18 at 14:10
  • Thanks jennifer, the output doesn't display any table named blockedips, I'd expect to see such a table listed (similar to this: block drop on en1 from <badhosts> to any). Could it be that the table is not active? At the end of the ouput of sudo pfctl -s all, do you see a TABLES section that lists badblocks? Could you add the output of sudo pfctl -T test 93.184.220.291? – jaume Aug 29 '18 at 14:39
2

I made a mistake:

Blocking in the IP is archieved via:

Inserting

block drop inet from any to 93.184.220.29
block drop inet from any to 93.184.220.70

In

 sudo nano /etc/pf.conf
1

My friend, your netstat tells me your machine is connected to the usual webserver port on the foreign host. You likely have running in the background a web browser open to that host.

Next, the syntax of your filter rules does not reflect well your intent. Your elected default for a policy will affect behavior, in conjunction to rulesets. Additionally, a thorough assessment can not be had without the full pf.conf and any anchor files or includes... Better still if you included the output of

sudo pfctl -vvv -s all

if memory serves me well...

The quick and dirty...

block in
block out

block in quick all from x.x.x.x to any
block out quick all from any to x.x.x.x

...but better if these were evaluated in context of the whole config.

F.

  • I added the output of sudo pfctl -vvv -s all. I now see that pf is not blocking the ports that I want it to block – jennifer ruurs Aug 30 '18 at 13:12
  • @jenniferruurs I hope that helped. Take care, – Francis from ResponseBase Aug 31 '18 at 1:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .