Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I want to test a fallback strategy for my memcached driver (in case port is protected by firewall). How can I deny access to a specific port, on

share|improve this question
depending on which version of MacOS you are using, use either jaume's answer (= you are on 10.7 or later) or mine (you are on 10.6). –  Florenz Kley Nov 14 '12 at 12:07
@FlorenzKley: Thank you both for the answers, I upvoted both of them. I decided to accept answer, as I am on OSX Snow Leopard :) –  Vlad Zloteanu Nov 20 '12 at 16:44
oh wow :-) thank you Vlad. –  Florenz Kley Nov 23 '12 at 22:03
:P :) Thank you for the answer! ;) –  Vlad Zloteanu Nov 23 '12 at 22:06
add comment

3 Answers

up vote 1 down vote accepted

Example for Mac OS X 10.6 (Snow Leopard)

to deny connections to localhost, port SSH (= 22, read from /etc/services):

sudo ipfw add deny tcp from any to localhost ssh
share|improve this answer
add comment

You can use pfctl.

OS X 10.7 "Lion" and later use the OpenBSD PF (Packet Filter). A pseudo-device called /dev/pf allows user space tools to configure the packet filter. The command pfctl provides most of the functionality.

To filter port 1234 on the loopback interface you can use a rule like this:

block quick on lo0 proto tcp from any to any port 1234

This rules blocks all inbound/outbound traffic on lo0 for port 1234 (quick means in this context that if this rule matches, no further rule should be applied).

The command to load the rule in PF is:

$ (sudo pfctl -sr 2>/dev/null; echo "block quick on lo0 proto tcp from any to any port 1234") | sudo pfctl -nf -

Command pfctl -sr 2>/dev/null lists all current rules (and sends the pretty annoying error message No ALTQ support in kernel ALTQ related functions disabled to /dev/null). The echo adds the rule above to the output, which is piped to pfctl. Option -n means don't apply, just check.

If there's no error message, you can apply the rule as follows (only difference: there's no -n):

$ (sudo pfctl -sr 2>/dev/null; echo "block quick on lo0 proto tcp from any to any port 1234") | sudo pfctl -f -

If you wish you can list the rules and check it has been added properly:

$ sudo pfctl -sr 2>/dev/null
block drop quick on lo0 proto tcp from any to any port = 1234

When you're done, load the original set of rules like this:

sudo pfctl -f /etc/pf.conf 

(I've tested the whole procedure on OS X 10.8.2 and worked flawlessly.)

You can find more information in this excellent introduction: http://nomoa.com/bsd/gateway/pf/valid/pfctl.html.

ipfw is still included in OS X 10.7 and 10.8 but is deprecated:

IPFW(8)                   BSD System Manager's Manual                  IPFW(8)

     ipfw -- IP firewall and traffic shaper control program (DEPRECATED)


     Note that use of this utility is DEPRECATED. Please use pfctl(8) instead.
share|improve this answer
I thought it was customary to add a comment to explain a downvote, is something wrong in my answer? –  jaume Nov 24 '12 at 13:44
add comment

@jaume If there is no pf.cong file and then I run your command suggestion,

sr 2>/dev/null; echo "block quick on lo0 proto tcp from any to any port 123") | sudo pfctl -f -

is there a similar command I could use to also delete the entry ?

I am basically trying to block the route to the NTP server.

share|improve this answer
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.