glennschler/Block VNC ARD.md

## Block VNC ARD.md

      
    Raw
  

              Block VNC ARD.md
            
          
    Referencing this discussion on how to deny loopback access, create the opposite which is to only allow access from localhost. The goal is to only allow access after the client has connected with SSH using the port tunneling option.
Add new filter rules to block VNC (port 5900) access when not connected via SSH with port forwarding.
Plus add blocks to file sharing (SMB and AFP).
Just in case I am running a web server block that too,
or any other ports listed in this link.
# pfctl is the packet filter firewall for modern OS X. 
# For more info -> man pfctl
# flush to the default
sudo pfctl -f /etc/pf.conf

# view the current PF rules
sudo pfctl -sr 2>/dev/null

echo 'tunnelPorts = "{ 80, 443, 8080, 5900 }"' > pf_vnc.conf
echo 'doNotSharePorts = "{ 139, 445, 548 }"' >> pf_vnc.conf
echo 'block drop in proto tcp from any to any port $tunnelPorts' >> pf_vnc.conf
echo 'block drop in proto tcp from any to any port $doNotSharePorts' >> pf_vnc.conf

# allow those TCP ports on localhost, assuming client has connected with tunneling
echo 'pass in quick on lo0 proto tcp from any to any port $tunnelPorts' >> pf_vnc.conf

# Now apply all those rules
(sudo pfctl -sr 2>/dev/null; cat pf_vnc.conf) | sudo pfctl -f - 2>/dev/null

Verify the current rules
sudo pfctl -sr 2>/dev/null

# If rules look good. Enable PF if it was not already enabled
sudo pfctl -e

Reset the rules by setting back to the default configuration
sudo pfctl -f /etc/pf.conf