Skip to content

Instantly share code, notes, and snippets.

@geoff-nixon

geoff-nixon/PF - OSX (OpenBSD) Firewall.md

Forked from flackend/PF - OSX (OpenBSD) Firewall.md
Created July 1, 2020 14:15
Show Gist options
  • Star 2 You must be signed in to star a gist
  • Fork 1 You must be signed in to fork a gist
  • Save geoff-nixon/11a3fca0f00b35e608ab7a74b13813f1 to your computer and use it in GitHub Desktop.
Save geoff-nixon/11a3fca0f00b35e608ab7a74b13813f1 to your computer and use it in GitHub Desktop.
Download ZIP
PF - OSX (OpenBSD) Firewall
Raw
PF - OSX (OpenBSD) Firewall.md

Resources

Using pfctl

These are the flags used in the exampe commands below:

  • v Verbose output
  • f Load rules from a file
  • n Parse rules, don't apply
  • e Enable the packet filter
  • d Disable the packet filter

Dry run:

pfctl -nvf /path/to/some.conf

Note: The f flag has to be last in the list in the above example. It's taking the path the follows as its argument.

If there were no syntax errors, apply the rules:

pfctl -evf /path/to/some.conf

This, I think, just disables the firewall:

sudo pfctl -d

Flush all filter parameters and reload the default rules, /etc/pf.conf:

pfctl -F all -f /etc/pf.conf

PF rules

Ordering

You need to order your declaration in this order:

  1. Options -- tune the behaviour of the packet filtering engine
  2. Normalization -- protects internal machines against inconsistencies in Internet protocols and implementations
  3. Queueing -- provides rule-based bandwidth control
  4. Translation -- specify how addresses are to be mapped or redirected to other addresses
  5. Filtering -- provides rule-based blocking or passing of packets

I believe it's possible to disable the enforcement of ordering, but if you do that your rules probably won't work the way you want.

Macros

Macros can be defined that will later be expanded in context. Macro names must start with a letter, and may contain letters, digits and underscores. Macro names may not be reserved words (for example pass, in, out). Macros are not expanded inside quotes.

# Define an external interface to use in the following rules
ext_if = "en0"
pass in on $ext_if proto tcp from any to any port 25

Anchors

Anchors are containers that can hold rules, address tables, and other anchors.

  • nat-anchor - nat rules
  • rdr-anchor - rdr rules
  • binat-anchor - binat rules
  • anchor - filter rules
rdr-anchor "example"
load anchor "example" from "path/to/example.rule"

Tables

When you define a table you can specify:

  • persist - keep the table after there are no rules using
  • const - table cannot be added to or have items removed
table <block> persist

Redsocks

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment