Skip to content

Instantly share code, notes, and snippets.

@flackend

flackend/PF - OSX (OpenBSD) Firewall.md

Last active February 25, 2024 21:53
Show Gist options
  • Star 21 You must be signed in to star a gist
  • Fork 6 You must be signed in to fork a gist
  • Save flackend/7c999c943ab46f4bfe34 to your computer and use it in GitHub Desktop.
Save flackend/7c999c943ab46f4bfe34 to your computer and use it in GitHub Desktop.
Download ZIP
PF - OSX (OpenBSD) Firewall
Raw
PF - OSX (OpenBSD) Firewall.md

Resources

Using pfctl

These are the flags used in the exampe commands below:

  • v Verbose output
  • f Load rules from a file
  • n Parse rules, don't apply
  • e Enable the packet filter
  • d Disable the packet filter

Dry run:

pfctl -nvf /path/to/some.conf

Note: The f flag has to be last in the list in the above example. It's taking the path the follows as its argument.

If there were no syntax errors, apply the rules:

pfctl -evf /path/to/some.conf

This, I think, just disables the firewall:

sudo pfctl -d

Flush all filter parameters and reload the default rules, /etc/pf.conf:

pfctl -F all -f /etc/pf.conf

PF rules

Ordering

You need to order your declaration in this order:

  1. Options -- tune the behaviour of the packet filtering engine
  2. Normalization -- protects internal machines against inconsistencies in Internet protocols and implementations
  3. Queueing -- provides rule-based bandwidth control
  4. Translation -- specify how addresses are to be mapped or redirected to other addresses
  5. Filtering -- provides rule-based blocking or passing of packets

I believe it's possible to disable the enforcement of ordering, but if you do that your rules probably won't work the way you want.

Macros

Macros can be defined that will later be expanded in context. Macro names must start with a letter, and may contain letters, digits and underscores. Macro names may not be reserved words (for example pass, in, out). Macros are not expanded inside quotes.

# Define an external interface to use in the following rules
ext_if = "en0"
pass in on $ext_if proto tcp from any to any port 25

Anchors

Anchors are containers that can hold rules, address tables, and other anchors.

  • nat-anchor - nat rules
  • rdr-anchor - rdr rules
  • binat-anchor - binat rules
  • anchor - filter rules
rdr-anchor "example"
load anchor "example" from "path/to/example.rule"

Tables

When you define a table you can specify:

  • persist - keep the table after there are no rules using
  • const - table cannot be added to or have items removed
table <block> persist

Redsocks

@JustynF
Copy link

JustynF commented Dec 17, 2021

Hey man just a heads up that first link in the resources leads to some pretty gnarly asian porn site

@flackend
Copy link
Author

@JustynF thanks for the heads up! Link has been removed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment