Skip to content

Instantly share code, notes, and snippets.

@carlossless
Last active December 14, 2023 15:49
Show Gist options
  • Save carlossless/dcc6c02a92b49bde0f13 to your computer and use it in GitHub Desktop.
Save carlossless/dcc6c02a92b49bde0f13 to your computer and use it in GitHub Desktop.
Port Forwarding (8080 -> 80) with `pf` on Mavericks/Yosemite

Jenkins Port Forwarding (8080 -> 80) with pf on Mavericks/Yosemite

This guide is a fork from this gist. I've added minor adjustments to customise these rules to forward connections from an outsite interface like en0.

Since Mavericks stopped using the deprecated ipfw (as of Mountain Lion), we'll be using pf to allow port forwarding.

1. Create the anchor file

Create an anchor file under /etc/pf.anchors/com.jenkins with your redirection rule like:

rdr pass on en0 inet proto tcp from any to any port 80 -> 127.0.0.1 port 8080

P.S. Make sure to add a newline at the end of this file.

2. Test the anchor file

Parse and test your anchor file to make sure there are no errors:

sudo pfctl -vnf /etc/pf.anchors/com.jenkins

3. Reference the anchor in pf.conf

/etc/pf.conf is the main configuration file that pf loads at boot. We'll need to load the anchor file we previously created:

rdr-anchor "com.jenkins"
load anchor "com.jenkins" from "/etc/pf.anchors/com.jenkins"

Make sure to add these entries to the appropriate spot, like:

scrub-anchor "com.apple/*"
nat-anchor "com.apple/*"
rdr-anchor "com.apple/*"
rdr-anchor "com.jenkins"
dummynet-anchor "com.apple/*"
anchor "com.apple/*"
load anchor "com.apple" from "/etc/pf.anchors/com.apple"
load anchor "com.jenkins" from "/etc/pf.anchors/com.jenkins"

4. Load and enabling pf

pf is not enabled by default in Mavericks, few ways to enable this:

  • Manually load and enable from a pf.conf file via sudo pfctl -ef /etc/pf.conf

  • Auto enable by adding an -e(enable) to the pfctl ProgramArgument in /System/Library/LaunchDaemons/com.apple.pfctl.plist like this:

<key>ProgramArguments</key>
<array>
	<string>pfctl</string>
	<string>-e</string>
	<string>-f</string>
	<string>/etc/pf.conf</string>
</array>

Caution

There is the possibility that pf.conf will be overriden with updates to the OS. It might be best to create your own pf config file and load them in additon to the main pf.conf to prevent this.

@Xronger
Copy link

Xronger commented Oct 19, 2014

Work it, thanks

@jukibom
Copy link

jukibom commented Jan 26, 2015

Just a quick one, I get a syntax error when testing the anchor file. Adding a newline at the end of the file fixes it.

Thanks for this, it's been really helpful!

@carlossless
Copy link
Author

Ok, I'll leave a note, regarding that, thanks!

@rainbow23
Copy link

Thanks, work it!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment