A stateful firewall program, common on BSD systems and also available on others.

learn more… | top users | synonyms

1
vote
0answers
34 views

Mac OS X firewall settings

I'm having some issues with setting up firewall on Mac OS X El Capitan version 10.11.4. I have number of network interfaces including en3, which is my main ethernet connection and and gif0 which is ...
1
vote
0answers
40 views

Mac OSX proxying

On my mac (OS X Mavericks), I am trying to redirect all the outgoing calls to a server (192.168.1.2) to a proxy server (192.168.1.3). I am using the following command (assuming that I don't need any ...
1
vote
0answers
29 views

bsd (osx) pf nat - change source port on outgoing UDP packets

I am running docker-machine on osx. docker-machine is running NAT so when my container send out a UDP packet on port 1812, NAT is translating it to some random port. I am playing around with pf nat (...
1
vote
0answers
249 views

pf error - “No ALTQ support in the kernel”… What does this mean?

I am running Mac OS X. I would like to be able to configure pf because it seems to be more sophisticated and flexible than the default Mac OS X firewall that you can access through the System ...
2
votes
0answers
30 views

Bind apps to VPN network interface with group based routing policies

My goal is to bind some applications to a specific network interface (tun0). I believe my best option would be that of creating special routing rules for applications launched with a specific group (...
0
votes
0answers
38 views

Block traffic when VPN disconnects

I want to connect to a VPN using the command line tool OpenVPN. To stop ingoing and outgoing traffic when the VPN disconnects because of some problems, I want to use the OpenBSD Packet Filter (PF). I ...
0
votes
0answers
73 views

OSX: PF 'antifspoof' rule blocks ntalk packets…

I'm trying to get to work ntalk between my two macs inside my local network and found a problem with my pf firewall configuration. When I do $ talk user@macbookpro.local gettng: [No connection ...
2
votes
0answers
290 views

How to block a port from all traffic on all interfaces in Mac OS X 10.10.5 (Yosemite)

I need to block port 27017 to do some testing but I can’t seem to figure out how to do it in Mac OS X 10.10.5 (Yosemite). I know that sometime ago they moved from iptables to pf tables, but the ...
0
votes
1answer
251 views

PF firewall: How to disable all filtering on loopback interface EXCEPT specific port forwarding rules?

PF question on OS X Yosemite 10.10.4: I know that set skip on lo0 disables all filtering (nat and redirects) on lo0, but what if I need to save the httpd port forwarding rules on this interface while ...
0
votes
0answers
92 views

Can I reference multiple interfaces in OS X pf with wildcards?

I use /etc/pf.conf and pfctl from within a program to programmatically block and unblock network interfaces. When I for example want to unblock all tunnel interfaces I want to unblock all interfaces ...
5
votes
1answer
2k views

OSX 10.11 (El Capitan beta) pf.conf behaviour changed?

I kind of expected things to break, but ... My pf forwarding rules, which worked previously on Yosemite, no longer work on 10.11. My forwarding rule is as follows: rdr pass on lo0 inet proto tcp ...
0
votes
0answers
37 views

How to make a PF filter by packet size?

I am looking for a PF option that can filter UDP packets according to their packet sizes. iptables has an option --length, but I could not find an equivalent option for PF.
1
vote
0answers
263 views

How to route traffic through two different network adapters based on TCP port in OS X

(cross-posting from ServerFault, as this forum seems more appropriate for this question) I have a scenario where we will be using a Mac to stream video content to an RTMP server. This RMTP service ...
0
votes
1answer
82 views

OS X OpenVPN packet filtering

I currently have an OpenVPN connection running on my Mac. By default, all of my network traffic is currently being routed through this connection: http, ssh, etc. I'm attempting to use packet ...
0
votes
0answers
26 views

OS X iptables owner equivalent OR use only vpn for specific user

I am trying to make sure all network traffic initiated by a specific user on OS X Yosemite will go through a specific vpn or otherwise be blocked. I imagine I could do that easily on linux using ...
0
votes
1answer
596 views

PF: Can't open port on OS X

Have troubles opening the port 9 on os x 10.10.3 yousemite using pf firewall. I want to do this for being able to get wake-on-lan packets to this port. I assume that for WoL to work the port (on the ...
1
vote
0answers
59 views

How do I intercept HTTP traffic on OS X?

I saw this tutorial: http://www.ex-parrot.com/pete/upside-down-ternet.html and I tried to implement a part of it on OS X 10.10. One command used there is iptables -A PREROUTING -s 192.168.0.0/255....
0
votes
1answer
118 views

Timeout on some connections (OpenBSD/PF with NAT)

I am getting "ERR_CONNECTION_TIMEOUT" on chrome for certain sites only (e.g. www.lemonde.fr). This does not happen when I use a proxy or if I access the site from my firewall. For the context, I use ...
0
votes
1answer
235 views

Block ICMP flood from a specific IP with pf

I'm getting a lot of ICMP throttle messages in my system.log: Apr 11 20:45:28 kernel[0]: Limiting icmp unreach response from 1054 to 250 packets per second Apr 11 20:45:29 kernel[0]: Limiting icmp ...
1
vote
0answers
148 views

PF rule using return-rst on Mac OS X does not reply with TCP reset

I'm trying to add a simple PF rule: block return-rst out proto tcp from any to any port 33128 to filter all outgoing traffic to TCP port 33128, and I'd like it to respond with a reset. However, ...
0
votes
0answers
74 views

How can one redirect to a new host all traffic destined for an old host?

We're moving a bunch of services, say from 1.2.3.4 to 5.6.7.8. In order to test that the new services are correctly configured, we'd like to redirect (to the new host) all traffic destined for the ...
3
votes
0answers
233 views

How to use new keyword dummynet-anchor in pf.conf of Mac OS X

Mac OS X introduced a new keyword “dummynet-anchor” in pf.conf file, which not used in FreeBSD and OpenBSD. The ipfw was removed in Mac OS X 10.10, How to use “dummynet-anchor”? UPDATE: What portion ...
3
votes
0answers
508 views

Port forwarding outgoing request with PF

I'm trying to redirect all outgoing traffic from my local machine on port 843, to go to my local service on port 1234. So, when I make a request to e.g. 1.2.3.4:843, I want it to connect to 127.0.0.1:...
5
votes
1answer
3k views

limiting upload bandwidth in Mac OS X Yosemite (10.10)

I have ADSL internet, and when there is an application uploading to the Internet at full speed (e.g. Skype or Chrome during file uploads), the download bandwidth becomes very very slow. Meaning I ...
1
vote
1answer
429 views

OS X, packet filter (PF), route-to options

I was trying to setup "policy based" routing with pfctl (PF) on OS X 10.10, however no matter what i do, i am getting "syntax error" from pfctl. config is rather simple: cat ./test.conf inf="en0" ...
0
votes
1answer
522 views

Share internet as Bridge instead as a Router using PFCTL (OS X)?

I've got an Airport Time Capsule (TC) and a Macbook Air (MBA) and another PC. The MBA connects the TC wirelessly while the PC connects to the MBA with Ethernet cable. The problem: The MBA takes the ...
0
votes
1answer
217 views

OpenBSD: Prioritizing empty ACKs

There is a wildly used example concerning PF and prioritising empty ACK packets, so that an an asynchronous connections' downstream does not lose performance, if the upstream is clogged up. The ...
0
votes
1answer
3k views

Equivalent iptables command on OS X 10.9

I want to redirect the tcp traffic temporarily to a custom port. On Linux, I use the following command: iptables -t nat -A OUTPUT -p tcp --dport 1935 -m owner \! --uid-owner root -j REDIRECT and to ...
0
votes
1answer
565 views

allow SSH to bypass VPN on OSX mavericks, openvpn, pf

My home computer connects to the internet through an OpenVPN connection. However, I would like to be able to connect to my home computer from outside over ssh. Ssh is set up and working, but when I ...
0
votes
1answer
105 views

how to access a range of public IPs only through a VPN?

For security reasons, I am not supposed to access an otherwise public IP range unless a VPN is up. However, if my VPN is down, my system routes to the IP anyway, which is a breach of my obligations. ...
0
votes
1answer
682 views

Configure Packet Filter with white-list and black-list

I’m trying to configure Packet Filter on a FreeBSD server with a black-list of addresses/networks to block and a white-list of trusted users which cannot be blocked (black-listed). Here is my first ...
0
votes
1answer
137 views

OpenBSD pf Egress Filtering

I am attempting to build a simple pf.conf which includes NAT allowing traffic out of the network from all systems on a select series of ports. In my basic configuration I have an internal server that ...
0
votes
2answers
646 views

Packet filter logging [currently with tcpdump in background as root]

I am running OS X Mavericks and use the "packet filter" firewall. However, it seems that "pflogd" is not available. I found that you can create an interface named pflog0 and then use tcpdump to see ...
7
votes
1answer
929 views

OS X: From ipfw to pfctl - Forward port 80 and 443

I found a way to forward ports 80 and 443 to other arbitrary ports (3000 and 3001 in my case) using ipfw. But ipfw is deprecated and replaced by pfctl. Here are my ipfw declarations: sudo ipfw flush ...
2
votes
0answers
1k views

How to open a server port outside of an OpenVPN tunnel with a pf firewall on OSX (BSD)

I have a Mac mini that I use as a media server running XBMC and serves media from my NAS to my stereo and TV (which has been color calibrated with a Spyder3Express, happy). The Mac runs OSX 10.8.2 and ...
4
votes
1answer
345 views

Hints on diagnosing performance issue in OpenBSD firewall

My OpenBSD 4.6 pf firewall has started having really bad performance in the past few weeks. I've isolated the firewall (as opposed to the WAN connection, switch, cable, etc.) as the problem, but need ...