2

I am trying to use pf firewall on macos Catalina 10.15.3 to allow www (80,443) access for a specific local IP address on my home network. This local IP address will request web pages from a nginx instance. If I turn off the macos firewall in settings=>Security & Privacy then the www is successful and the nginx is displayed. However, I cannot get the request through for the specific IP address when the firewall is enabled. Initially my nginx setup listens on port 80 and 443.

Following this I tried investigating how to configure the pf firewall to allow the request through for a specific IP address. My /etc/pf.conf is currently as follows:

#
# com.apple anchor point
#
scrub-anchor "com.apple/*"
nat-anchor "com.apple/*"
rdr-anchor "com.apple/*"
dummynet-anchor "com.apple/*"
anchor "com.apple/*"
load anchor "com.apple" from "/etc/pf.anchors/com.apple"

#
# only allow www traffic on wifi interface from a specific LAN ip address
#
www_services = "{ http, https }"
pass quick inet proto tcp from <the LAN IP address> to any port $www_services keep state
#int_if = "en0"
#table <allowed> { <the LAN IP address> } persist
#block in quick from urpf-failed
#block return in quick on $int_if proto tcp from !<allowed> to $int_if port 80

Can anyone help?

I am enabling pf firewall using pfctl -E and disabling with pfctl -X <token>

Interestingly, if I configure nginx to listen on a different port other than port 80 and then add nginx to the list of allowed applications in the Security & Privacy firewall, the request is allowed through.

However, I suspect this is allowed through for all IP addresses on the LAN and all ports nginx listens to?? I am trying to configure the Packet filter firewall (pf) so that the IP address and port is restricted. Maybe port 80 is root reserved ports hence the reason why it was blocked???

How do I get pf firewall to only allow a specific IP address through for a http request on a specific port, e.g. 8080?

Improve this question

1 Answer 1

Reset to default
0

Interestingly, if I configure nginx to listen on a different port other than port 80 and then add nginx to the list of allowed applications in the Security & Privacy firewall, the request is allowed through.

so just add 80 and 443 to it as well. (In case you did, you didn't reveal that.)

Those are 2 different firewalls in use, thus it means they both need to be allowing traffic. Even if one is open too wide, it's restricted with another.

Improve this answer
7
  • Yep I tried that and will update question. Have recently read this post which might possibly work. It highlights that ports 80 and port 443 are root privileged. So maybe the solution is to have nginx listen to non root privileged ports and use pf to redirect incoming port 80/443 tcp requests to nginx. Will give it a try when I get a moment.
    – dcs3spp
    Apr 9, 2020 at 12:28
  • Also note that 80 is even and 443 is odd. Why? Well, same relevance as them being "privileged ports". It does relate to firewall in no way.
    – poige
    Apr 9, 2020 at 13:19
  • Any other suggestions?
    – dcs3spp
    Apr 9, 2020 at 16:22
  • Only to read my answer attentively
    – poige
    Apr 9, 2020 at 16:26
  • I do not understand your answer...could you explain constructively in a different way? Adding 80 and 443 to nginx and firewall does not work!
    – dcs3spp
    Apr 9, 2020 at 16:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .