1

I am newbie with pf. I want to modify all outgoing TCP traffic having destination port 8001. For that, firstly, I wanted to use pf to redirect all the TCP traffic at en0 with destination port 8001 to lo0 port 8001 and then redirect it to lo0 port 8003. But this does not work.

These are the contents of my pf.conf file:

# Default PF configuration file.
#
# This file contains the main ruleset, which gets automatically loaded
# at startup.  PF will not be automatically enabled, however.  Instead,
# each component which utilizes PF is responsible for enabling and disabling
# PF via -E and -X as documented in pfctl(8).  That will ensure that PF
# is disabled only when the last enable reference is released.
#
# Care must be taken to ensure that the main ruleset does not get flushed,
# as the nested anchors rely on the anchor point defined here. In addition,
# to the anchors loaded by this file, some system services would dynamically
# insert anchors into the main ruleset. These anchors will be added only when
# the system service is used and would removed on termination of the service.
#
# See pf.conf(5) for syntax.
#

#
# com.apple anchor point
#
scrub-anchor "com.apple/*"
nat-anchor "com.apple/*"
rdr-anchor "com.apple/*"
rdr pass log on lo0 proto tcp from any to any port 8001 -> 127.0.0.1 port 8003
dummynet-anchor "com.apple/*"
anchor "com.apple/*"
load anchor "com.apple" from "/etc/pf.anchors/com.apple"
pass out on en0 route-to lo0 proto tcp from en0 to any port 8001 keep state
~                                                                                               
~                                                                                               
~     

After this I loaded my pf.conf file with sudo pfctl -ef /etc/pf.conf The output of which was

pfctl: Use of -f option, could result in flushing of rules
present in the main ruleset added by the system at startup.
See /etc/pf.conf for further details.

No ALTQ support in kernel
ALTQ related functions disabled
pf enabled

To check if the rule is being hit or not I tried

sudo pfctl -vsn

The output was

nat-anchor "com.apple/*" all
  [ Evaluations: 31        Packets: 0         Bytes: 0           States: 0     ]
  [ Inserted: uid 0 pid 2294 ]
rdr-anchor "com.apple/*" all
  [ Evaluations: 98        Packets: 0         Bytes: 0           States: 0     ]
  [ Inserted: uid 0 pid 2294 ]
rdr pass log on lo0 inet proto tcp from any to any port = 8001 -> 127.0.0.1 port 8003
  [ Evaluations: 98        Packets: 0         Bytes: 0           States: 0     ]
  [ Inserted: uid 0 pid 2294 ]

After this I created and sent three TCP SYN packets from scapy with

  1. sport = 8001 to dstIP = 192.168.1.9 dport = 8000
  2. sport = 8001 to dstIP = 192.168.1.9 dport = 8001
  3. sport = 8001 to dstIP = 192.168.1.9 dport = 8002

Now, when I sniff with scapy at port 8003 and with Wireshark at lo0, no packet is captured. I am confused, where am I going wrong. Please help.

You must log in to answer this question.

Browse other questions tagged .