27

I am running Mac OS X. I would like to be able to configure pf because it seems to be more sophisticated and flexible than the default Mac OS X firewall that you can access through the System Preferences. I tried using some pf commands and got some errors that I don't understand.

bash-3.2$ sudo pfctl -s rules
No ALTQ support in kernel
ALTQ related functions disabled
scrub-anchor "com.apple/*" all fragment reassemble
anchor "com.apple/*" all
bash-3.2$ sudo pfctl -s states
No ALTQ support in kernel
ALTQ related functions disabled

I looked up ALTQ on Wikipedia and it seems to be a queueing program that does statistical multiplexing of packets at the kernel level. It is the kernel module that BSD systems use for queueing of packets. And the Mac OS X kernel apparently doesn't support it.

Okay, so this doesn't really make sense. Why would Mac OS X include the BSD pf firewall but not include support for the queueing software necessary to make that firewall work? Isn't that kind of counter-productive? There must be some way to turn support for ALTQ on, but I have no idea what it is. I'm not even entirely sure what ALTQ is. Is it a loadable kernel module that I have to load using the kextload command? Or is the problem that it's already there but the kernel is just incompatible with it. I am utterly confused.

3
  • What version of OS X?
    – Spiff
    Dec 27, 2015 at 5:41
  • @Spiff I get this with 10.9.5
    – ian
    Jun 29, 2016 at 13:18
  • Same here with 10.12.6 Dec 24, 2017 at 7:36

2 Answers 2

5

You need to enable Firewall:
System Preferences -> Security & Privacy -> Firewall -> Turn On Firewall
(Under the hood it doing sudo pfctl -E)

if you would try after that : sudo pfctl -s info it shouldn't blame about ALTQ

2
  • 9
    For OSX 10.11.6 this wasn't working for me. It is still printing: No ALTQ support in kernel ALTQ related functions disabled
    – d0x
    Oct 24, 2017 at 14:43
  • 1
    Both firewalls seem unrelated. In previous versions of OS X, the firewall accessible in System Preferences was the "Application Firewall" which was independent of the low level firewall ipfw (which was replaced by pf). More information is available at PF on Mac OS X. Dec 24, 2017 at 7:36
3

I believe you have mistaken the output of your command:

sudo pfctl -s rules

The ouput lists a warning:

No ALTQ support in kernel

With further information regarding that warning:

ALTQ related functions disabled

It then goes on to list the active rules as requested:

scrub-anchor "com.apple/*" all fragment reassemble
anchor "com.apple/*" all

You can find some further information, including the meaning of the output above, here:

https://krypted.com/mac-security/a-cheat-sheet-for-using-pf-in-os-x-lion-and-up/

I use Little Snitch on macOS, which as I remember, but could be wrong, uses pf for the backend.

ALTQ is used for traffic shaping. Here is information on traffic shaping (and ALTQ) for the pfSense open source project. pfSense, as its name suggests, utilizes pf and is based on FreeBSD, which macOS is also (to an extent). I only give it to provide to information about ALTQ (and what pf is capable of in relation).

https://docs.netgate.com/pfsense/en/latest/book/trafficshaper/index.html

I would venture to comment that ALTQ traffic shaping might be better served at an edge firewall/router than on a workstation, and no great loss that it is not enabled on macOS (as Apple has abandoned it as a meaningful server operating system and focused on consumer desktop application usage). YMMV.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.