I have a mac that's connected to a VPN, where the VPN's gateway is the system's default gateway for all outgoing traffic. This means that I cannot connect to any services running on my mac from some arbitrary IP outside of my local network, even when port forwarding is set up correctly on my router, because the source IP address of the connection will be a non-local IP and therefore the system will try to route it through the VPN, not through my local gateway.

However, I think it might be possible to use pf to route this traffic differently based purely on its port number. What I'd want is to have the default gateway for a connection on a specific port to be my local gateway, rather than the VPN, regardless of what the source IP address is. (If I knew the IP in advance, I could just set up a static route.)

Is it possible to do this? If so, how would I configure pf to do so? (Perhaps it's possible to use pf to select a different routing table for the connection based on its port?)

  • Not 100% sure, but since traffic is already routed on the VPN virtual interface, the firewall will have no effect. You have to change the routing of traffic that was changed by the VPN client. It’s best to get the network admin to modify the VPN policy
    – Allan
    Feb 14, 2023 at 17:49
  • This is a privacy VPN service I use personally, and I've set it up myself using OpenVPN / Viscosity, so I can change whatever aspect of its configuration I want. I think what I'm after with pf would be selecting a different routing table based on the port number, which I seem to recall is possible but don't really know how to do it.
    – Bri Bri
    Feb 14, 2023 at 18:09
  • You should not have to change routing tables manually. When the VPN connects, it is configured to route either all traffic (what you’re doing now) or just traffic bound for the destination. When I did Cisco and Sonicwall VPNs, these were always done at the server.
    – Allan
    Feb 14, 2023 at 18:12

1 Answer 1


If you need to route specific traffic over a different gateway then you can enable split tunneling - the vpn client controls pf and the local route table.


Not sure I 100% understand the question, but hopefully this helps.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .