A stateful firewall program, common on BSD systems and also available on others.

learn more… | top users | synonyms

0
votes
1answer
13 views

Timeout on some connections (OpenBSD/PF with NAT)

I am getting "ERR_CONNECTION_TIMEOUT" on chrome for certain sites only (e.g. www.lemonde.fr). This does not happen when I use a proxy or if I access the site from my firewall. For the context, I use ...
0
votes
0answers
31 views

Routing RDP traffic to Windows 7 VM using pf

I have a machine running OS X Server which has a Windows VM running via Parallels. I need to route traffic from the external adapter on port 3389 to an internal/virtual adapter. I have tried quite a ...
0
votes
1answer
39 views

Block ICMP flood from a specific IP with pf

I'm getting a lot of ICMP throttle messages in my system.log: Apr 11 20:45:28 kernel[0]: Limiting icmp unreach response from 1054 to 250 packets per second Apr 11 20:45:29 kernel[0]: Limiting icmp ...
0
votes
0answers
21 views

PF rule using return-rst on Mac OS X does not reply with TCP reset

I'm trying to add a simple PF rule: block return-rst out proto tcp from any to any port 33128 to filter all outgoing traffic to TCP port 33128, and I'd like it to respond with a reset. However, ...
0
votes
0answers
32 views

How can one redirect to a new host all traffic destined for an old host?

We're moving a bunch of services, say from 1.2.3.4 to 5.6.7.8. In order to test that the new services are correctly configured, we'd like to redirect (to the new host) all traffic destined for the ...
1
vote
0answers
88 views

How to use new keyword dummynet-anchor in pf.conf of Mac OS X

Mac OS X introduced a new keyword “dummynet-anchor” in pf.conf file, which not used in FreeBSD and OpenBSD. The ipfw was removed in Mac OS X 10.10, How to use “dummynet-anchor”? UPDATE: What portion ...
1
vote
0answers
117 views

Port forwarding outgoing request with PF

I'm trying to redirect all outgoing traffic from my local machine on port 843, to go to my local service on port 1234. So, when I make a request to e.g. 1.2.3.4:843, I want it to connect to ...
1
vote
1answer
1k views

limiting upload bandwidth in Mac OS X Yosemite (10.10)

I have ADSL internet, and when there is an application uploading to the Internet at full speed (e.g. Skype or Chrome during file uploads), the download bandwidth becomes very very slow. Meaning I ...
0
votes
1answer
158 views

OS X, packet filter (PF), route-to options

I was trying to setup "policy based" routing with pfctl (PF) on OS X 10.10, however no matter what i do, i am getting "syntax error" from pfctl. config is rather simple: cat ./test.conf inf="en0" ...
0
votes
1answer
199 views

Share internet as Bridge instead as a Router using PFCTL (OS X)?

I've got an Airport Time Capsule (TC) and a Macbook Air (MBA) and another PC. The MBA connects the TC wirelessly while the PC connects to the MBA with Ethernet cable. The problem: The MBA takes the ...
0
votes
1answer
104 views

OpenBSD: Prioritizing empty ACKs

There is a wildly used example concerning PF and prioritising empty ACK packets, so that an an asynchronous connections' downstream does not lose performance, if the upstream is clogged up. The ...
0
votes
1answer
2k views

Equivalent iptables command on OS X 10.9

I want to redirect the tcp traffic temporarily to a custom port. On Linux, I use the following command: iptables -t nat -A OUTPUT -p tcp --dport 1935 -m owner \! --uid-owner root -j REDIRECT and to ...
0
votes
0answers
155 views

SOCKS5 proxy only, git wants to use ssh to xx.xx.xx.xx - forward? - mac os

I have SOCKS5 proxy configured and want to work with the git repository, originally cloned from ssh:... So when it tries to connect the error "Network is unreachable" appears. There are a few ...
0
votes
1answer
346 views

allow SSH to bypass VPN on OSX mavericks, openvpn, pf

My home computer connects to the internet through an OpenVPN connection. However, I would like to be able to connect to my home computer from outside over ssh. Ssh is set up and working, but when I ...
0
votes
1answer
75 views

how to access a range of public IPs only through a VPN?

For security reasons, I am not supposed to access an otherwise public IP range unless a VPN is up. However, if my VPN is down, my system routes to the IP anyway, which is a breach of my obligations. ...
0
votes
1answer
374 views

Configure Packet Filter with white-list and black-list

I’m trying to configure Packet Filter on a FreeBSD server with a black-list of addresses/networks to block and a white-list of trusted users which cannot be blocked (black-listed). Here is my first ...
0
votes
1answer
96 views

OpenBSD pf Egress Filtering

I am attempting to build a simple pf.conf which includes NAT allowing traffic out of the network from all systems on a select series of ports. In my basic configuration I have an internal server that ...
0
votes
2answers
440 views

Packet filter logging [currently with tcpdump in background as root]

I am running OS X Mavericks and use the "packet filter" firewall. However, it seems that "pflogd" is not available. I found that you can create an interface named pflog0 and then use tcpdump to see ...
6
votes
1answer
546 views

OS X: From ipfw to pfctl - Forward port 80 and 443

I found a way to forward ports 80 and 443 to other arbitrary ports (3000 and 3001 in my case) using ipfw. But ipfw is deprecated and replaced by pfctl. Here are my ipfw declarations: sudo ipfw flush ...
2
votes
0answers
1k views

How to open a server port outside of an OpenVPN tunnel with a pf firewall on OSX (BSD)

I have a Mac mini that I use as a media server running XBMC and serves media from my NAS to my stereo and TV (which has been color calibrated with a Spyder3Express, happy). The Mac runs OSX 10.8.2 and ...
4
votes
1answer
250 views

Hints on diagnosing performance issue in OpenBSD firewall

My OpenBSD 4.6 pf firewall has started having really bad performance in the past few weeks. I've isolated the firewall (as opposed to the WAN connection, switch, cable, etc.) as the problem, but need ...