2

I am running an application that regularly phones home and reports a little more information than I'm comfortable with. I would normally add the reporting server's hostname to /etc/hosts, but the app does not perform a DNS lookup and connects directly by IP. I am looking to use Lion's built in PF firewall to achieve this.

I understand that a commercial utility like LittleSnitch would make this a trivial endeavor. However, this is not a viable solution for me. I find their asking price too high, and the built in firewall should be able to do the trick.

I've been using IceFloor to modify the PF configuration to block incoming connections with great success. However, I'm running into some problems blocking outgoing connections. From what I've read, the following rule should be correct:

block return-rst out quick on en0 inet proto tcp from any to xxx.xxx.230.191

It should block only TCP packets to that IP and reply with a RST packet. It seems to be blocking the packets properly, but instead of returning an RST packet, it is silently dropping the outgoing packets. This is causing the app to hang while it waits for the connection attempt to timeout.

Is this rule written correctly to achieve what I would like to achieve? Has anyone else attempted something like this using PF?

  • 1
    You may be able to setup a dead preferred route for the IP (random thought). see man route. make all connections to the specific IP try to route through the lo interface. – Fake Name May 13 '12 at 5:09
1

My friend, if memory serves me well, you will need to add

net.inet.tcp.icmp_may_rst=0

to /etc/sysctl.conf, and then modify the running kernel-

sudo sysctl -w net.inet.tcp.icmp_may_rst=0

That should do the trick. If no /etc/sysctl.conf exists, here is a shortcut:

sudo echo “net.inet.tcp.icmp_may_rst=0” >> /etc/sysctl.conf
sudo chmod 644 /etc/sysctl.conf

Hope that resolves the inconsistency with PF.

F.

  • Would one need to disable System Integrity Protection to modify sysctl.conf? – kccricket Dec 31 '18 at 17:20
  • A qualified no is my answer. I would be shocked if this were needed. – Francis from ResponseBase Dec 31 '18 at 23:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .