I am running an application that regularly phones home and reports a little more information than I'm comfortable with. I would normally add the reporting server's hostname to /etc/hosts, but the app does not perform a DNS lookup and connects directly by IP. I am looking to use Lion's built in PF firewall to achieve this.
I understand that a commercial utility like LittleSnitch would make this a trivial endeavor. However, this is not a viable solution for me. I find their asking price too high, and the built in firewall should be able to do the trick.
I've been using IceFloor to modify the PF configuration to block incoming connections with great success. However, I'm running into some problems blocking outgoing connections. From what I've read, the following rule should be correct:
block return-rst out quick on en0 inet proto tcp from any to xxx.xxx.230.191
It should block only TCP packets to that IP and reply with a RST packet. It seems to be blocking the packets properly, but instead of returning an RST packet, it is silently dropping the outgoing packets. This is causing the app to hang while it waits for the connection attempt to timeout.
Is this rule written correctly to achieve what I would like to achieve? Has anyone else attempted something like this using PF?