1

I want to make my computer more secure and a part of it I want to do with reconfiguring my PF firewall.

How can I reconfigure my PF.conf to be more secure?

I made a github repo where I posted my configuration. My first github repo

  • Have you tried this (simpler) firewall example? – Seamus Sep 8 '18 at 16:51
  • try adding log to more rules (all of the blocks) and see if anything is getting shot down – thrig Sep 9 '18 at 0:07
  • @thrig what should I add? – jennifer ruurs Sep 9 '18 at 4:56
  • @Seamus those are different than mine rules and I don't want to remove the firewall settings of Apple and If I add those lines to the pf.conf I get a error – jennifer ruurs Sep 9 '18 at 5:07
  • Hi - could you perhaps edit to show the test you are making that shows that your internet is broken? Details like the IP address or subnet for your DNS server might help us help you. Also - you might need to use comments in your PF conf so that your intent is clear - there’s going to be a ton of time for someone to absorb each of the rules you have in place to understand and then guess why you have each rule blocking traffic. – bmike Sep 11 '18 at 3:11
1

Okay, the config is a total mess without some comments so we can know what you’re thinking instead of what you have written. No worries, let us get this sorted out. The syntax employed does not reflect well your intent, and in a few instances is in error or redundant.

It also appears that the ruleset you describe that is the config is not the same as that which you say is the output of the pfctl.

For clarity’s sake, let us make this simple, and more informative. Please post the output of

sudo pfctl -vvv -s all

Then, please post your complete pf.conf - preferably to a place where we can comment and discuss like github or github gist. I’m seeing some discrepancies between the two files you posted (thanks for those), so I recommend explicitly writing out in NON FIREWALL SYNTAX - JUST PLAIN ENGLISH what exactly you want pf to do.

Since I recognize a series of questions we might be at the point of diminishing returns asking larger and more detailed questions I will watch for your reply, and will make an extra effort to get this right for you but this might be a challenge in the Q&A format here. Thanks for your patience in providing some more work as to what you need to work.

  • I’m going to edit out some ALL caps in a bit. Let’s get the OP to post their full rules to github gist or similar. This may be more of a call for consulting than a clear question to be answered, but let’s see if the string of questions on PF gets us to the one “true” answer - have a reason for making each new rule and test. Once the OP clearly knows which exact line breaks things - this will be far simpler to help them. I applaud your efforts to help answer here. +1 indeed – bmike Sep 11 '18 at 3:04
  • I made a my first github repo github.com/jenniferruurs/Macfirewall feel free to make any comments – jennifer ruurs Sep 11 '18 at 5:27
  • Okay, Jennifer -- aside from the launchctl registration which might require a reboot into single user to disable system integrity protection, I believe that you are all set as I just forked your Github repo, added the relevant files, wrote a nice Readme.md with instructions, and did a pull request for you to merge my branch to your original repo. – Francis from ResponseBase Sep 14 '18 at 0:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .