0

All, I'm new to pf please forgive my ignorance in advance. I'm attempting to block an SSDP/UDP Broadcast from my Plex Server on a Mac Mini to the LAN. The Mac Mini is on internal IP address 192.168.2.11.

Issue for reference with pretty WireShark photos on Plex Forums here

PF is running and my specific rules are loaded in an anchor file which are in place as listed below with block rules at bottom.

Mac-mini-6:~ User$ sudo pfctl -vnf /etc/pf.conf

pfctl: Use of -f option, could result in flushing of rules
present in the main ruleset added by the system at startup.
See /etc/pf.conf for further details.

scrub-anchor "/*" all fragment reassemble
nat-anchor "/*" all
rdr-anchor "/*" all
anchor "/*" all
anchor "/*" all
dummynet-anchor "/*" all

Loading anchor com.apple from /etc/pf.anchors/com.apple
anchor "/*" all
anchor "/*" all

Loading anchor plex-ssdp.block from /etc/pf.anchors/plex-ssdp.block
block drop out quick on en0 proto udp from any to any port = 1900
block drop out quick on en1 proto udp from any to any port = 1900


Mac-mini-6:~ User$ sudo pfctl -vnf /etc/pf.anchors/plex-ssdp.block
pfctl: Use of -f option, could result in flushing of rules
present in the main ruleset added by the system at startup.
See /etc/pf.conf for further details.

block drop out quick on en0 proto udp from any to any port = 1900
block drop out quick on en1 proto udp from any to any port = 1900

I'm attempting to block this broadcast (below) from 192.168.2.11 which is the Mac Mini itself running Plex but my rules don't seem to work.

$sudo tcpdump -n -s0 port 1900 and udp
IP 192.168.2.11.53952 > 239.255.255.250.1900: UDP, length 101

The pf firewall is of course running and rules are working with no errors:

Mac-mini-6:~ User$ sudo pfctl -vvv -s all
No ALTQ support in kernel
ALTQ related functions disabled
TRANSLATION RULES:
@0 nat-anchor "com.apple/*" all
  [ Owner : nil          Priority : 0     ]
  [ Evaluations: 46275     Packets: 0         Bytes: 0           States: 0     ]
  [ Inserted: uid 0 pid 511 ]
@0 rdr-anchor "com.apple/*" all
  [ Owner : nil          Priority : 0     ]
  [ Evaluations: 105227    Packets: 0         Bytes: 0           States: 0     ]
  [ Inserted: uid 0 pid 511 ]

FILTER RULES:
@0 scrub-anchor "com.apple/*" all fragment reassemble
  [ Owner : nil          Priority : 0     ]
  [ Evaluations: 180874    Packets: 0         Bytes: 0           States: 0     ]
  [ Inserted: uid 0 pid 511 ]
@0 anchor "com.apple/*" all
  [ Owner : nil          Priority : 0     ]
  [ Evaluations: 105266    Packets: 0         Bytes: 0           States: 0     ]
  [ Inserted: uid 0 pid 511 ]
@1 anchor "plex-ssdp.block/*" all
  [ Owner : nil          Priority : 0     ]
  [ Evaluations: 105266    Packets: 0         Bytes: 0           States: 0     ]
  [ Inserted: uid 0 pid 511 ]

DUMMYNET RULES:
@0 dummynet-anchor "com.apple/*" all
  [ Owner : nil          Priority : 0     ]
  [ Evaluations: 0         Packets: 0         Bytes: 0           States: 0     ]
  [ Inserted: uid 0 pid 511 ]

INFO:
Status: Enabled for 0 days 03:42:26           Debug: Urgent

At this point I'm not certain what I've missed. Running tcpdump shows the broadcast and replies (see below) Thanks in advance!

listening on pktap, link-type PKTAP (Apple DLT_PKTAP), capture size 262144 bytes
12:07:51.775753 IP 192.168.2.11.53952 > 239.255.255.250.1900: UDP, length 101
12:07:51.782263 IP 192.168.2.12.1900 > 192.168.2.11.53952: UDP, length 289
12:07:51.783203 IP 192.168.2.15.1900 > 192.168.2.11.53952: UDP, length 289
12:07:51.783207 IP 192.168.2.3.1900 > 192.168.2.11.53952: UDP, length 247
12:07:51.783208 IP 192.168.2.6.1900 > 192.168.2.11.53952: UDP, length 447
12:07:51.783209 IP 192.168.2.3.1900 > 192.168.2.11.53952: UDP, length 251
12:07:51.783210 IP 192.168.2.6.1900 > 192.168.2.11.53952: UDP, length 449
12:07:51.783211 IP 192.168.2.15.1900 > 192.168.2.11.53952: UDP, length 275
12:07:51.783211 IP 192.168.2.12.1900 > 192.168.2.11.53952: UDP, length 275
12:07:51.783212 IP 192.168.2.16.1900 > 192.168.2.11.53952: UDP, length 272
12:07:51.783213 IP 192.168.2.12.1900 > 192.168.2.11.53952: UDP, length 287
12:07:51.784444 IP 192.168.2.15.1900 > 192.168.2.11.53952: UDP, length 287

migrated from serverfault.com Jan 22 at 17:33

This question came from our site for system and network administrators.

You must log in to answer this question.