Enable packet filter on macOS

README.md

Run

launchctl load -w /Library/LaunchDaemons/local.pfctl.plist

Explanation

macOS 10.11 introduced System Integrity Protection, which makes /System (and consequently /System/Library/LaunchDaemons/com.apple.pfctl.plist) immutable, even to root. This means the plist can't be modified to enable packet filter (by adding the -E switch to pfctl). The solution is to create a custom launchd daemon, which only calls pfctl -E (calling pfctl -E -f /etc/pf.conf conflicts with com.apple.pfctl.plist, which may cause failure and pf not being enabled).

local.pfctl.plist

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Disabled</key>
    <false/>
    <key>Label</key>
    <string>local.pfctl</string>
    <key>WorkingDirectory</key>
    <string>/var/run</string>
    <key>Program</key>
    <string>/sbin/pfctl</string>
    <key>ProgramArguments</key>
    <array>
            <string>pfctl</string>
            <string>-E</string>
    </array>
    <key>RunAtLoad</key>
    <true/>
    <key>StandardErrorPath</key>
    <string>/var/log/local.pfctl.err</string>
    <key>StandardOutPath</key>
    <string>/var/log/local.pfctl.out</string>
</dict>
</plist>