Skip to main content

Questions tagged [pfctl]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1 vote
1 answer
2k views

Port forwarding on macOS Sonoma 14.1.1 (23B81)

I would like to setup port forwarding on my MacBook, but I don`t get it working, even after studying a lot of questions here and other blog posts. I have some SSH tunels opened from another machine to ...
Oliver F.'s user avatar
0 votes
0 answers
147 views

MacOS Ventura: How to permanently disable pftctl

I'm on MacOS Ventura on M1 Apple Silicon. Something keeps re-enabling pfctl that blocks my internet access roughly every 10 minutes. I'm no expert in macos or pfctl but after a bit of googling, I ...
CybaTronX's user avatar
1 vote
1 answer
772 views

iptables like forwarding of packets with pfctl on mac os

I would like to build a bridge between two interfaces with pf, like with iptables: sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE sudo iptables -A FORWARD -i eth0 -o wlan0 -m state --...
ptiza_v_nebe's user avatar
0 votes
1 answer
195 views

Internet connection is disabled after updating the pf.conf file

I am trying to redirect traffic on all ports to my local server by editing the pf.conf file on MacBook. pf.conf file content: # # Default PF configuration file. # # This file contains the main ruleset,...
1n4ho12's user avatar
-1 votes
1 answer
706 views

Why is PF not working on M1?

I don't understand why PF does not work on M1. This problem is only on M1. I tried turning firewall on/off. PF successfully enabled without my code /etc/pf.conf scrub-anchor "com.apple/*" ...
yepev97979's user avatar
1 vote
0 answers
83 views

How to prevent customized pfctl's rule is overridden by system?

I add a rule in /etc/pf.conf: scrub-anchor "com.apple/*" nat-anchor "com.apple/*" nat on utun4 from en5:network to 132.128/9 -> (utun4) <= this is added rdr-anchor "com....
neo's user avatar
  • 11
3 votes
1 answer
770 views

Forward foo:8080 to localhost:8081 while keeping localhost:8080 available

To emulate the CI integration testing environment for the application that I’m working with, I want to be able to have the following mapping of requests happen: foo:8080 ⟶ localhost:8081 bar:8080 ⟶ ...
Donald Hosek's user avatar
2 votes
1 answer
982 views

Port forwarding

I would like to intercept the tcp traffic from a device on my network. I cannot change the destination but I set the router IP to the IP of my M1 Mac Mini. I used to do this with ipfw on a virtual ...
PatrickB's user avatar
0 votes
0 answers
255 views

Map one IP to another

On Linux, I can use iptables to cause any incoming requests $FROM destined for some IP address to go to another $TO, regardless of whether $FROM and/or $TO where actually on the interface, or even ...
DrownedSuccess's user avatar
0 votes
1 answer
2k views

How to open a port on MacOS Big Sur?

I am trying to open a specific port (8000) on my Mac (macOS 11.6) for local web development testing. Let’s say my computer’s NAT IP is 192.168.1.10. If I go to 192.168.1.10:8000, I get nothing. nmap ...
Jason's user avatar
  • 1,116
2 votes
2 answers
2k views

Port Forwarding on macOS Monterey

I've switched to macOS Monterey and am not able to get port forwarding working for localhost (http and https) using the loopback interface lo0. I'm using pf and doing exactly what I was doing before ...
Daniel Flippance's user avatar
6 votes
0 answers
680 views

Source of PF 'anchor "com.apple.internet-sharing" all'?

I see someone had/has the same issue I'm seeing here, but I can't find an answer to it. What I'm trying to do: create a packet filter that is applied to any device that's sharing internet. My use ...
firefever's user avatar
1 vote
0 answers
159 views

Modifying tcp packets going out on a specific port

I am newbie with pf. I want to modify all outgoing TCP traffic having destination port 8001. For that, firstly, I wanted to use pf to redirect all the TCP traffic at en0 with destination port 8001 to ...
Arti Dua's user avatar
1 vote
2 answers
795 views

How to dynamically add anchors on startup for apple pfctl without editing system pf.conf

There are a few answers on using pfctl on os x, but none really give a nice clean way to make an anchor and have it loaded on startup, or to allow programs to hook in and dynamically update / replace ...
nate's user avatar
  • 11
2 votes
3 answers
536 views

Starting `pf` Firewall at System Startup

I have a particular machine that I keep buttoned down very tight. Only a few specific ports/protocols are allowed. I have a pretty basic set of rules that work very well. While working on a different ...
l008com's user avatar
  • 1,746
2 votes
1 answer
2k views

MacOS pf equivalent to iptables rule

I am looking to implement a rule like the following iptables rule on my Mac. sudo iptables -t nat -A OUTPUT -d 10.244.1.8 -p tcp --dport 4369 -j DNAT --to-destination 127.0.0.1:4369 Context: In my ...
Diogo Ferreira's user avatar
1 vote
0 answers
69 views

How to use pf to route this scenario

Scenario I need pf on a Mac to do this: redirecting any connections to localhost:8080 to a public domain. --> localhost:8080 --> public domain Example The public domain is hosting a nginx server. ...
Tran Triet's user avatar
2 votes
1 answer
391 views

PF not forwarding incoming traffic on loopback from one port to another

Scenario I have a server listening on port 3000 on localhost. I want incoming traffic to localhost:8080 to be forwarded to that server. My set up: Server listens on port 3000; nothing listens on ...
Tran Triet's user avatar
1 vote
2 answers
1k views

pf: Dynamically add rule to nat-anchor

I connect to a Cisco VPN Server and want to share that connection via wifi. Using the macOS Internet Sharing feature, I can only select one interface to share - either my LAN adapter, or the VPN ...
CygnusOlor's user avatar
2 votes
0 answers
232 views

MacOS pf.anchor gets reset after OS upgrade?

I want to add custom network rules to pf.anchor/com.apple instead of pf.conf. I read from https://blog.neilsabol.site/post/quickly-easily-adding-pf-packet-filter-firewall-rules-macos-osx/ that mention ...
John's user avatar
  • 21
3 votes
3 answers
757 views

PF set condition for not equal to a list of ports for MacOS

I'd like to set a condition so that a firewall rule will not apply to a list of ports, something along the lines of this: table <my_table> persist file "/etc/pf.anchors/entries" set skip on ...
GreekFire's user avatar
1 vote
2 answers
212 views

Why can't I create new network connections after enabling PF with a simple custom ruleset using `pfctl -f`?

Why can't I create new network connections after enabling PF with a simple custom ruleset using pfctl -f? I'm reading the official FAQ tutorial for OpenBSD's PF firewall, also used in macOS. I've a ...
Shuzheng's user avatar
  • 1,521
4 votes
1 answer
9k views

How to forward traffic from one machine to another with `pfctl`?

I am trying to forward traffic like this: Internal Network Computer (192.168.1.*) → Server (192.168.186:1234) → Internal Network Computer (192.168.1.198:80) Server is plugged into the router via ...
user7886229's user avatar
  • 10.1k
3 votes
1 answer
369 views

pf redirect rules don't work logging

TL;DR: On Mojave (haven't tested on others), when creating rdr rules in pf, the rules work for a while (with some issues accessing the target port directly), but after a while the rules stop working, ...
Burke Libbey's user avatar
1 vote
1 answer
338 views

Where can i find the source code for the pfctl utility?

I have looked here: https://github.com/apple/darwin-xnu But all i can find is the 'back end' for the pfctl tool, but i am interested in the command-line pfctl tool itself, the option parser and so on....
horseyguy's user avatar
  • 183
0 votes
1 answer
962 views

How to do IP masquerading on MacOS (10.14+)?

I am looking for the equivalent Macos command to the linux: sudo iptables -t nat -A POSTROUTING -o en0 -j MASQUERADE I notice there are some very very old solutions using the ancient ipfw firewall, ...
horseyguy's user avatar
  • 183
0 votes
1 answer
527 views

How to route traffic out a non-standard interface using pfctl?

I have a VPN which has setup a default route, which is (of course) different to my gateway. All my traffic therefore gets routed through the tunnel. however i would like to exempt certain apps from ...
horseyguy's user avatar
  • 183
1 vote
3 answers
4k views

PF Firewall : Every time I use `pfctl`, I get errors about ALTQ support

I have a slightly elaborate firewall setup where my server usually has between 400 and 800 ip addresses firewalled. It switches back and forth between two different pf tables. Every day it rebuilds ...
l008com's user avatar
  • 1,746
1 vote
1 answer
2k views

Routing localhost traffic to external IP address

I have a host with Mac OS and another machine (192.168.100.50) in the same LAN. I would like to configure Mac OS in that way if I access localhost:443 it will redirect to 192.168.100.50:443. I'm able ...
Sergey Zwezdin's user avatar
2 votes
1 answer
1k views

Redirect IP traffic with 'pfctl' on macOS

I'm working on a mac with OS 10.13.6. I want to redirect all requests to 10.20.154.24:1111 made from my computer go to localhost:8080. I read about pf and pfctl, but could not make this work. I ...
Yuval's user avatar
  • 121
1 vote
1 answer
970 views

use `pf` to allow TCP traffic on specific port (from specific subnet)

So, I've read various posts about how to use both the Application Firewall (apf or socketfilterfw) and the Packet Filter (pf) at the same time. I thought this would be straightfoward since I'm not a ...
crimson-egret's user avatar
2 votes
0 answers
35 views

Getting notification when firewall settings have changed

I'm using packet filter engine to setup my Firewall connection. However, there might be other entities that may override my firewall settings on the same way (processes running with 'root' privileges ...
Zohar81's user avatar
  • 621
0 votes
0 answers
245 views

Passing L2TP over IPSec VPN through a `pf` Firewall

I am trying to set up some custom firewall rules in the pf firewall in macOS (10.11 in this case). These are traditional network-based rules, not application-specific rules. I'm having some issues: ...
l008com's user avatar
  • 1,746
1 vote
1 answer
3k views

Mapping port 80 to 8080 but maintain explicit 8080 access

I followed the instructions in this answer to map port 8080 to 80 on my mac. This works a treat, except for the fact that I can no-longer access http://localhost:8080 explicitly through Chrome (it ...
Ed_'s user avatar
  • 113
2 votes
1 answer
1k views

Is the firewall really pfctl, or another instance of pfctl?

I was mucking around with pfctl a while back, didn't get very far and forgot about it. Yesterday, I couldn't ssh into a remote machine. I disabled the firewall in system preferences but still had the ...
ian's user avatar
  • 471
2 votes
2 answers
5k views

pfctl to add rules at runtime WITHOUT editing /etc/pf.conf?

I have an app that (while it is running and only while it is running) needs to make changes to the packet filter (pf) so that it blocks or allows certain traffic. These rules should be in addition to ...
horseyguy's user avatar
  • 183
4 votes
1 answer
2k views

Redirect Local Port through bridge to Internet Shared static IP

I have my cable modem (10.0.0.1) to my iMac (10.0.0.36), and my iMac (10.0.0.36) with a (bridge100 192.168.2.1) Internet Shared IP to my debian machine (192.168.2.34), and all of that is working ...
Jeffrey L. Roberts's user avatar
9 votes
2 answers
12k views

pfctl - howto add an anchor and make it active / load it

So i can add an anchor to the already enabled firewall by doing something like this: $ pfctl -a anchor_name -f /etc/anchor_rules.txt the file "anchor_rules.txt" might contain something like this: ...
Motsel's user avatar
  • 969