2

I want to run ipfw or pf on my iPhone -- or the equivalent. Seems simple, but I can't find anything that works.

Device is jailbroken, looked very carefully through Cydia, and even through some of the alternate repositories. I've tried off and on for months, digging and digging, it's been really frustrating.

I found this post: Can I block ports and network traffic when using Personal Hotspot? here on apple.stackexchange, and tried installing ipfw via theworm.altervista.org/cydia. It installed without issue, but no matter what I do it just says:

ipfw: getsockopt(IP_FW_GET): Protocol not available

Found this post: http://nixcraft.com/all-about-freebsd-openbsd-netbsd/3726-ipfw-getsockopt-ip_fw_get-protocol-not-available.html which suggests creating a file: /etc/rc.conf, with the following:

firewall_enable="YES"
firewall_script="/usr/local/etc/ipfw.rules"

But that didn't help at all, still get the same error.

I'm aware of the Cydia/commercial software "IP Firewall", which would help with much of what I want to do, but not everything.

Please help!

1

This thread over the FreeBSD forums suggests that pf works on iOS. Disclaimer: I haven't tested this myself.

Edit:

pfctl -sr

as root returns:

No ALTQ support in kernel
ALTQ related functions disabled

and no rules whatsoever, but it seems that pf is there

We're looking for long answers that provide some explanation and context. Don't just give a one-line answer; explain why your answer is right, ideally with citations. Answers that don't include explanations may be removed.

  • Got it. I'm searching/reading all over the place, trying to get a handle on what this all means (getting a little over my head). I did pfctl -vvv -s info and got a whole boatload of stuff that I don't understand (yet), but does indeed look like something is running. Can I presume that ALTQ isn't necessary for merely blocking (or not) traffic? What I'm trying to do is essentially whitelist all traffic on an iPhone. Start with *nothing open, then open only to a few, known servers. From what you know (and I know some of this may be new to you), do you think this is possible using pf? – peter.r Mar 16 '13 at 21:41
  • Interesting development. ALTQ support is required only for traffic shaping and shouldn't interfere with running pf. It's of note that OS X also doesn't contain ALTQ support in its kernel. From what I'm reading, there isn't really any reason pf shouldn't be able to run on iOS. And apparently, it's been available since v4. – user10355 Mar 16 '13 at 21:56
  • @peter.r : pf should be quite similar to ipfw (and iptables, although iptables is not used by Apple, as it is a Linux, not *BSD thing); however pf was developed originally for OpenBSD, and ipfw was developed for FreeBSD. Therefore pf should be able to do everything or most of everything that could be done in ipfw and maybe even more. Apple is depreciating ipfw in OS X (although it is still there in 10.8), seems like they are doing the same in iOS. As for setting up pf -- I never got to learn it, as OS X still supports ipfw. – lupincho Mar 17 '13 at 6:36
  • Sorry for the delay, but I'm accepting this answer and thank you for the help. I haven't got it all figured out yet, but this answer/link helped get me started, and I have at least a somewhat functional firewall in place. If I have further questions on this topic I'll go ahead and post a separate question (like whether or not operating in user space means that certain apps may be able to bypass my firewall, etc.) Thanks for your efforts as well, cksum. – peter.r Mar 26 '13 at 22:53
1

It seems "simple", but ipfw (or pf) require support directly within the kernel. That means Apple has to compile the iOS kernel to support those particular utilities and their required protocols (ipfw is a front end for ipfw and dummynet, the latter of which does the bandwidth shaping).

Firewall software (like ipfw) in Unix based systems run at the kernel layer (deep) and cannot be added unless the kernel itself supports them. OS X supports ipfw/pf but iOS does not. Apple has gone through great lengths to secure the OS and likely feels it an unnecessary addition (it's not that Apple has turned them off, they simply do not exist so no conf configurations will aid you). This is why you receive the protocol error. While iOS can run the program, ipfw cannot negotiate the required protocols because they simply do not exist.

At best, your only option is to find a firewall that runs atop the kernel, so in userspace (like Little Snitch on OS X for example).

  • This makes some sense to me, but how can you account for the thread in lupincho's answer below? I'm still trying to digest that thread, frankly. I'm a long-time developer, and have a basic understanding of firewalls (and have done a good amount of ipfw configuration on a couple of our servers), but I'm by no means a firewall or networking expert. – peter.r Mar 16 '13 at 20:25
  • If the info in the thread that I linked is correct, that doesn't change the general validity of cksum's argument (that firewalls of the ipfw/pf type need kernel support and userspace ones such as FirewallIP that you mentioned don't need it). It just means that pf is supported by the iOS kernel, something that cksum wasn't aware (and I wasn't aware of that either, before finding that link). – lupincho Mar 16 '13 at 20:52
  • Also, I would love to have a firewall that runs in userspace, like Little Snitch. I'm a happy (paid) Little Snitch owner. But Apple doesn't seem to allow such utilities. Cydia has IPFirewall, which I'd be happy to purchase, but it requires Facebook/Google authentication (why?!). I can't imagine any privacy-minded person that would willingly give their real, personal data to either of those companies. :-( – peter.r Mar 16 '13 at 20:59
0

I've always run Firewall iP on JB iOS, and really like it. http://cydia.saurik.com/package/com.yllier.firewall

I never checked that pfctl is also available on iOS -- it would be very nice to put together a iOS-oriented pf.conf and run the iOS firewall at load time to have a kernel-level firewall.

It's also possible block malware, trackers, and adware by downloading a list of bad hosts from hphosts.org and appending this to the /etc/hosts file.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .