Looking for a way to control precisely which process or application is allowed to communicate with the network in a low connectivity context, I found the pfctl command which seems to be designed for the job.

I would like to allow only a few applications to connect to the network (ie: ping and Mail) and remove Apple unnecessary services.

Here is my current /etc/pf.conf file:

scrub-anchor "com.apple/*"
nat-anchor "com.apple/*"
rdr-anchor "com.apple/*"
dummynet-anchor "com.apple/*"
anchor "com.apple/*"
load anchor "com.apple" from "/etc/pf.anchors/com.apple"

I try to understand the pfctl status with this command:

$ sudo pfctl -sr
No ALTQ support in kernel
ALTQ related functions disabled
scrub-anchor "com.apple/*" all fragment reassemble
anchor "com.apple/*" all

Is it possible to achieve the filtering I want with pfctl and how?