I am trying to set up some custom firewall rules in the pf firewall in macOS (10.11 in this case). These are traditional network-based rules, not application-specific rules. I'm having some issues:

The syntax seems simple enough. But my rules aren't working properly.

table <VPN> { } persist
table <badhosts> persist

block in quick from <badhosts> to any
block in

pass in quick from <VPN> to any flags S/SA keep state
pass in quick proto tcp from any to any port { 25 80 443 587 993 } flags S/SA keep state
pass in quick proto { esp icmp ah } from any to any keep state
pass in quick proto udp from any to any port { 500 1701 4500 } keep state

The idea here is that:

  • <VPN> covers connections inbound from my VPN, all VPN traffic will be allowed.
  • <badhosts> is my own manually added list of IPs I want to block.
  • The last three rules should allow public traffic to connect to my web server, mail server, and to make connections to the VPN

I was having bigger problems initially, but I have poked around, gotten a little further, and edited this post.

I was getting a syntax error on the line block in quick from <badhosts> to any when it was at the bottom. I moved it above all the pass statements, gave it a quick keyword, and no more syntax error. But why was that causing a syntax error just from being below? Seems like it should have worked fine there.

More importantly, this config does seem to block all traffic, and it does seem to allow public traffic to access the web and mail server. But suddenly one thing I cannot do with it is connect to the VPN (that is, on another machine, I cannot connect to this machine which is running the VPN server, because I get stopped by it's firewall).

I'm hoping this is the only problem, and that once I can connect to the VPN, the rule regarding VPN traffic will work as expected.

The VPN is of type L2TP over IPSec. I must be missing some odd flag or protocol used for the VPN but I don't know what it is.

  • You have several questions in here. This site works better when there is only one question per question. That way, it's easier for other people to write good answers, and for others to find solutions if they have the same problem. Please ask the questions separately. – nohillside Sep 23 '18 at 14:21
  • I streamlined the question @nohillside, can you release the hold? – l008com Sep 24 '18 at 2:56

You must log in to answer this question.

Browse other questions tagged .