Questions tagged [pfctl]
The pfctl tag has no usage guidance.
24
questions
0
votes
0answers
16 views
How to reroute some ipv6 traffic using pf?
I have two ipv6 interfaces on my macOS machine. One of them (call it i1) has the default route and so all ipv6 traffic goes through it by default.
However, for certain ipv6 traffic (that on port 9999) ...
1
vote
1answer
75 views
MacOS pf equivalent to iptables rule
I am looking to implement a rule like the following iptables rule on my Mac.
sudo iptables -t nat -A OUTPUT -d 10.244.1.8 -p tcp --dport 4369 -j DNAT --to-destination 127.0.0.1:4369
Context: In my ...
1
vote
0answers
32 views
How to use pf to route this scenario
Scenario
I need pf on a Mac to do this: redirecting any connections to localhost:8080 to a public domain.
--> localhost:8080 --> public domain
Example
The public domain is hosting a nginx server. ...
1
vote
1answer
35 views
PF not forwarding incoming traffic on loopback from one port to another
Scenario
I have a server listening on port 3000 on localhost. I want incoming traffic to localhost:8080 to be forwarded to that server.
My set up:
Server listens on port 3000; nothing listens on ...
0
votes
0answers
120 views
pf: Dynamically add rule to nat-anchor
I connect to a Cisco VPN Server and want to share that connection via wifi.
Using the macOS Internet Sharing feature, I can only select one interface to share - either my LAN adapter, or the VPN ...
2
votes
0answers
56 views
MacOS pf.anchor gets reset after OS upgrade?
I want to add custom network rules to pf.anchor/com.apple instead of pf.conf. I read from https://blog.neilsabol.site/post/quickly-easily-adding-pf-packet-filter-firewall-rules-macos-osx/ that mention ...
3
votes
3answers
150 views
PF set condition for not equal to a list of ports for MacOS
I'd like to set a condition so that a firewall rule will not apply to a list of ports, something along the lines of this:
table <my_table> persist file "/etc/pf.anchors/entries"
set skip on ...
1
vote
2answers
95 views
Why can't I create new network connections after enabling PF with a simple custom ruleset using `pfctl -f`?
Why can't I create new network connections after enabling PF with a simple custom ruleset using pfctl -f?
I'm reading the official FAQ tutorial for OpenBSD's PF firewall, also used in macOS.
I've a ...
3
votes
1answer
3k views
How to forward traffic from one machine to another with `pfctl`?
I am trying to forward traffic like this:
Internal Network Computer (192.168.1.*) ā Server (192.168.186:1234) ā Internal Network Computer (192.168.1.198:80)
Server is plugged into the router via ...
3
votes
1answer
116 views
pf redirect rules don't work logging
TL;DR: On Mojave (haven't tested on others), when creating rdr rules in pf, the rules work for a while (with some issues accessing the target port directly), but after a while the rules stop working, ...
1
vote
1answer
105 views
Where can i find the source code for the pfctl utility?
I have looked here: https://github.com/apple/darwin-xnu
But all i can find is the 'back end' for the pfctl tool, but i am interested in the command-line pfctl tool itself, the option parser and so on....
0
votes
1answer
343 views
How to do IP masquerading on MacOS (10.14+)?
I am looking for the equivalent Macos command to the linux:
sudo iptables -t nat -A POSTROUTING -o en0 -j MASQUERADE
I notice there are some very very old solutions using the ancient ipfw firewall, ...
0
votes
1answer
201 views
How to route traffic out a non-standard interface using pfctl?
I have a VPN which has setup a default route, which is (of course) different to my gateway. All my traffic therefore gets routed through the tunnel.
however i would like to exempt certain apps from ...
0
votes
2answers
514 views
PF Firewall : Every time I use `pfctl`, I get errors about ALTQ support
I have a slightly elaborate firewall setup where my server usually has between 400 and 800 ip addresses firewalled. It switches back and forth between two different pf tables. Every day it rebuilds ...
1
vote
1answer
763 views
Routing localhost traffic to external IP address
I have a host with Mac OS and another machine (192.168.100.50) in the same LAN.
I would like to configure Mac OS in that way if I access localhost:443 it will redirect to 192.168.100.50:443.
I'm able ...
2
votes
1answer
564 views
Redirect IP traffic with 'pfctl' on macOS
I'm working on a mac with OS 10.13.6.
I want to redirect all requests to 10.20.154.24:1111 made from my computer go to localhost:8080.
I read about pf and pfctl, but could not make this work.
I ...
1
vote
1answer
335 views
use `pf` to allow TCP traffic on specific port (from specific subnet)
So, I've read various posts about how to use both the Application Firewall (apf or socketfilterfw) and the Packet Filter (pf) at the same time. I thought this would be straightfoward since I'm not a ...
2
votes
0answers
23 views
Getting notification when firewall settings have changed
I'm using packet filter engine to setup my Firewall connection. However, there might be other entities that may override my firewall settings on the same way (processes running with 'root' privileges ...
0
votes
0answers
134 views
Passing L2TP over IPSec VPN through a `pf` Firewall
I am trying to set up some custom firewall rules in the pf firewall in macOS (10.11 in this case). These are traditional network-based rules, not application-specific rules. I'm having some issues:
...
1
vote
1answer
1k views
Mapping port 80 to 8080 but maintain explicit 8080 access
I followed the instructions in this answer to map port 8080 to 80 on my mac. This works a treat, except for the fact that I can no-longer access http://localhost:8080 explicitly through Chrome (it ...
1
vote
1answer
558 views
Is the firewall really pfctl, or another instance of pfctl?
I was mucking around with pfctl a while back, didn't get very far and forgot about it.
Yesterday, I couldn't ssh into a remote machine. I disabled the firewall in system preferences but still had the ...
2
votes
1answer
1k views
pfctl to add rules at runtime WITHOUT editing /etc/pf.conf?
I have an app that (while it is running and only while it is running) needs to make changes to the packet filter (pf) so that it blocks or allows certain traffic. These rules should be in addition to ...
4
votes
1answer
957 views
Redirect Local Port through bridge to Internet Shared static IP
I have my cable modem (10.0.0.1) to my iMac (10.0.0.36), and my iMac (10.0.0.36) with a (bridge100 192.168.2.1) Internet Shared IP to my debian machine (192.168.2.34), and all of that is working ...
6
votes
1answer
6k views
pfctl - howto add an anchor and make it active / load it
So i can add an anchor to the already enabled firewall by doing something like this:
$ pfctl -a anchor_name -f /etc/anchor_rules.txt
the file "anchor_rules.txt" might contain something like this:
...
