I have a network location set up to ssh tunnel to my server. For now, just ssh -D type stuff. This works fine. I set up the tunnel from within my .screenrc. In other words, "screen" is the trigger to connect to my proxy. Before I type that I should not be able to go online. However, lynx and ping go through without problems. tunnel or not. This is disquieting.

How can I ensure all network traffic uses my Network settings, and not it's own? The only way packets should be leaving is via my DynamicForward port.

EDIT: The apple specificity comes with the Network settings, either accessed via System Preferences, or via networksetup.

OS X has both ipfw, and the application level firewall.

The appfirewall does not seem to stop things from going out. It stops connections to the system.

Ipfw does take precedence over the application firewall, apparently.

My SOCKS5 proxy is set up on a port, and I then give that port to in a network Location as the SOCKS5 proxy. This works fine. As I see it, programs should not get a choice about using the proxy, and indeed, if I turn it off, browsers can not access the web.

Linux and *BSD's do not have the various ( quite nifty ) things that OSX has in this regard. For them, it would be ipchains and ipfw, respectively.

I think I'm missing something. It should just work.

  • can you filter at the level of your router? Nov 10, 2010 at 21:05
  • also, you may have a better chance with this question on unix.se, superuser, or serverfault. It's not really apple specific so I'd actually propose that this is an off-topic/outside-scope question. However, close voting is disabled due to the open bounty. Nov 10, 2010 at 21:10
  • @calavera While I agree he might have better luck getting an answer on some of those sites and that there's nothing Apple specific about this question, the programs he mentions (with the exception of lynx) do ship with a Mac so it's not strictly off topic. Nov 10, 2010 at 21:23
  • @Kyle: true enough, I mostly was worried about whether he'd get a good answer on here or not. please see: meta.apple.stackexchange.com/questions/176/… Nov 10, 2010 at 23:43
  • @calavera, I am using an Airport Express router.
    – chiggsy
    Nov 12, 2010 at 5:05

2 Answers 2


Assuming that ssh is running on localhost (or another machine on the local subnet), the easiest thing to do is to shut down your routes so that nothing can get outside. netstat -nr will show you your current routes. Mine looks like this:

Destination        Gateway            Flags    Refs      Use  Netif Expire
default         UGSc       93     4438    en1 is my default route. If I take that route out: route delete default then I cannot get to any machine not wired to my network. Once screen sets up your proxy, you should have access back.

  • Note that commands may be different in Linux/Unix. OSX is a bit different in this area.
    – Jack M.
    Nov 10, 2010 at 21:24

You may want to have a look at man networksetup to see if it could give you what you are looking for.

  • 1
    This is probably more of a comment than an answer. Nov 13, 2010 at 3:31
  • I knew about networksetup... tricky issue though, networksetup seems to be a command line interface to similar functions to the gui. I'll have to run opensnoop to be sure, running strings implies that it is a level higher than the "kill switch", that route is.
    – chiggsy
    Nov 16, 2010 at 6:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .