I have a machine. I want to configure it so that it can only talk to (gitserver) and (localhost).

This machine is meant to be pure work, no distractions.

I'm on OS X Lion.

I'm familiar with iptables on Linux, but not sure how to configure this (or if it's even possible).

What do I need to read up to make this work?

PS: configuring the router is not an option; it's some simple $30 router.

  • 1
    download little snitch and set two rules to allow the ip addresses you want, and one rule to deny everything else – Billy Moon Jul 9 '12 at 4:26
  • Would an extra router be an option? – Thorbjørn Ravn Andersen Aug 22 '12 at 16:48
  • Pleas state the router model. Most $30 routers I know still have this via an admin interface for free. If it was a switch, forget it, they can't be programmed, but routers often can. Any info on the bottom (underneath)? – Michael Durrant Aug 26 '12 at 12:46

Mac OS X like other BSD systems uses ipfw instead of iptables. Read the man page for full reference.

One way to would be to deny all TCP "establish connection" packets except those directed to gitserver, leaving all other traffic untouched:

ipfw add allow tcp from me to gitserver setup
ipfw add allow tcp from me to me setup # may not be needed
ipfw add deny tcp from any to any setup

The rules will be lost on reboot, so they must be set on every boot (e.g. from /etc/rc.common or crontab's @reboot).

If that seems too complicated, get a third party firewall. Little Snitch is a good one, but it costs another $30 :)

| improve this answer | |

A little outside-the-box thought: Put a second network card into gitserver and connect the machine via that. Of course, routing should be disabled on gitserver.

Alternatively, assign your machine the IP, netmask and leave the "router" field empty. This basically means your machine can communicate directly only with and if there is no router configured, it doesn't know how to reach the outside world.

For both of these approaches, you need to be sure you don't need anything from "outside" - DNS, NTP, AppStore and application updates via network will not work with those setups.

| improve this answer | |

You must log in to answer this question.