1

How can I block/close (or drop all the packets coming from) all ports with PF except TCP port 80 and TCP 443? So I only want to make use of port 80 and 443 via TCP.

I tried this, but I receive an error

sudo gedit /etc/pf.conf

Content:

scrub-anchor "com.apple/*"
nat-anchor "com.apple/*"
rdr-anchor "com.apple/*"
dummynet-anchor "com.apple/*"
anchor "com.apple/*"
load anchor "com.apple" from "/etc/pf.anchors/com.apple"

set block-policy drop
pass in all keep state
pass out all keep state
block in proto tcp to port 80
block in proto tcp to port 443

block drop from any to 93.184.220.29
block drop from any to 93.184.220.70

The error:

sudo pfctl -v -n -f /etc/pf.conf
pfctl: Use of -f option, could result in flushing of rules
present in the main ruleset added by the system at startup.
See /etc/pf.conf for further details.

set block-policy drop
/etc/pf.conf:8: Rules must be in order: options, normalization, queueing, translation, filtering

I also tried the approach described in the link but that did also not work. Link to repo

  • The link you tried to use (github.com/ozkansener/Macdroppackets) is a very bad use of C and PF. The obtained PF file doesn't preserve the system definitions, and build a stupid list of blocking one port at a time among 65536. – dan Aug 30 '18 at 17:25
  • About the error message you got, I would have written it the same way. The set block-policy drop option is badly placed. What part of this error message would like to be clarified? – dan Aug 30 '18 at 17:35
  • Beware, your other rules are dangerous and in the wrong order, but pfctl won't give you an error message about this. From pfctl point of vue it is legit to let all packet pass. – dan Aug 30 '18 at 17:39
  • How would you suggest me to do it? I am really a beginner with PF. – jennifer ruurs Sep 1 '18 at 5:51

You must log in to answer this question.

Browse other questions tagged .