New answers tagged

1

To make it work you'd have to add that rule: pass quick on lo0 — I typically have it as the first line of filtering rulesets I manage. To be precise, even this would be enough: pass in quick on lo0 but why bothering with directions if you typically need it both ways on loopback anyways(?)…


0

You haven't allowed traffic on loopback meanwhile logs do show localhost is being used for resolving. One way would be to use set skip on lo0 but I'd advice using explicit pass quick on lo0 no state instead (put in addition to your ruleset of course — somewhere in its very beginning).


0

I've read that pf's firewall rules only applies to packets that (physically) pass the given interface. I remember answering to your similar question on unix.stackexchange.com Thus, rules for a gateway's external interface will not apply to packets entering on the local interface and destined for the external interface, since the TCP/IP stack handles such ...


2

One should clearly understand what Pf's "lists" are. They aren't a part of ruleset that gets loaded into kernel in fact, but macros instead. It means they're expanded during preprocessing phase of rules loading — contrary to tables. Keeping that in mind saves one from "shooting in own foot". Let's now see what you're trying to do: block out quick proto { ...


2

Open System Preferences -> Security & Privacy -> Firewall Select Firewall Options In the list set "sharingd" to "Allow Incoming Connections" Alternatively, tick "Automatically allow built-in software to receive incoming connections"


2

Figured it out: Is by negating each individual port, inside the delimiter { } block out quick proto { tcp, udp } from any to ! <my_table> port { != 66, != 80 } I found the 'op-list' section for specifying port here: https://man.openbsd.org/pf.conf.5 This shows you how to apply the logic of adding more ports


2

You can make the inverse command logic. First Block all, then open just the ones you want: The result is the same you tried by negating all except those chosen to be opened. :) set skip on lo port_pass = "{ 80 66 53 22 }" block all pass out on en0 proto { tcp, udp } to any port $port_pass keep state


Top 50 recent answers are included