Skip to content

Instantly share code, notes, and snippets.

Last active June 22, 2024 15:01
Show Gist options
  • Save flackend/7c999c943ab46f4bfe34 to your computer and use it in GitHub Desktop.
Save flackend/7c999c943ab46f4bfe34 to your computer and use it in GitHub Desktop.
PF - OSX (OpenBSD) Firewall


Using pfctl

These are the flags used in the exampe commands below:

  • v Verbose output
  • f Load rules from a file
  • n Parse rules, don't apply
  • e Enable the packet filter
  • d Disable the packet filter

Dry run:

pfctl -nvf /path/to/some.conf

Note: The f flag has to be last in the list in the above example. It's taking the path the follows as its argument.

If there were no syntax errors, apply the rules:

pfctl -evf /path/to/some.conf

This, I think, just disables the firewall:

sudo pfctl -d

Flush all filter parameters and reload the default rules, /etc/pf.conf:

pfctl -F all -f /etc/pf.conf

PF rules


You need to order your declaration in this order:

  1. Options -- tune the behaviour of the packet filtering engine
  2. Normalization -- protects internal machines against inconsistencies in Internet protocols and implementations
  3. Queueing -- provides rule-based bandwidth control
  4. Translation -- specify how addresses are to be mapped or redirected to other addresses
  5. Filtering -- provides rule-based blocking or passing of packets

I believe it's possible to disable the enforcement of ordering, but if you do that your rules probably won't work the way you want.


Macros can be defined that will later be expanded in context. Macro names must start with a letter, and may contain letters, digits and underscores. Macro names may not be reserved words (for example pass, in, out). Macros are not expanded inside quotes.

# Define an external interface to use in the following rules
ext_if = "en0"
pass in on $ext_if proto tcp from any to any port 25


Anchors are containers that can hold rules, address tables, and other anchors.

  • nat-anchor - nat rules
  • rdr-anchor - rdr rules
  • binat-anchor - binat rules
  • anchor - filter rules
rdr-anchor "example"
load anchor "example" from "path/to/example.rule"


When you define a table you can specify:

  • persist - keep the table after there are no rules using
  • const - table cannot be added to or have items removed
table <block> persist


Copy link

JustynF commented Dec 17, 2021

Hey man just a heads up that first link in the resources leads to some pretty gnarly asian porn site

Copy link

@JustynF thanks for the heads up! Link has been removed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment