Questions tagged [pf]
A stateful firewall program, common on BSD systems and also available on others.
56
questions
0
votes
0
answers
42
views
Mac OS - How to disable pf on boot
So, after months of hunting to work out why Private Relay isn't working, I eventually tracked it down to the fact that pf is running. When I disable pf with sudo pfctl -d then private relay becomes ...
- 101
1
vote
1
answer
65
views
How can I start the PF service without interrupting existing connections?
I have an Ansible playbook that starts the PF firewall. It freezes at this point because the SSH connection between the target and the host Ansible is executing on is interrupted as a result of this. ...
1
vote
2
answers
236
views
FreeBSD pf.conf. Error: "no IP address found for wlan0:network"
Every time I try to make some sensible pf rules - I fail. Need someone to help me with the puzzling syntax and mechanics of pf.
Here is my pf.conf:
1 # The name of our network interface as seen in `...
- 131
2
votes
1
answer
806
views
My network setup do not work. FreeBSD
This question was asked by me on serverfault.com. It was closed as off-topic, with a suggestion to ask here, on superuser. The OS is FreeBSD 13.0.
The setup that I need to establish is simple. In ...
- 131
0
votes
1
answer
2k
views
Port forwarding and NAT using pf on freebsd
I have a network router that connects three networks with the outside world. One of the internal networks is public facing the other two are not and connected via NAT. I am part of a larger network ...
- 193
0
votes
1
answer
495
views
Override "set skip on lo0" for PF firewall
I am using PF firewall and I want to redirect port on loopback interface, like this:
rdr on lo0 inet proto tcp from 127.0.0.1 to 127.0.0.1 port 443 -> 127.0.0.1 port 6443
The problem is, my VPN ...
- 103
2
votes
1
answer
4k
views
macos Catalina - Packet Filter (pf) firewall - how to restrict www access to a specific IP address on local network?
I am trying to use pf firewall on macos Catalina 10.15.3 to allow www (80,443) access for a specific local IP address on my home network. This local IP address will request web pages from a nginx ...
- 121
0
votes
2
answers
1k
views
Mac OSX: How to forward all outgoing traffic to specific host/port to different host/port?
I've been searching high and low for days and I'm 100% stuck with PF. Essentially I want to take all of my local, outbound traffic to ip/port redirect it to a different ip/port.
local application ...
2
votes
1
answer
437
views
pfctl divert-socket in mac os?
I'm messing with divert sockets in OSX, and in order to capture any socket, I first need to set up a firewall redirection (divertion if you will):
ipfw add divert 3282 tcp from any to any
Something ...
- 121
4
votes
1
answer
3k
views
How to do IP masquerading on MacOS 10.14+?
I am looking for the equivalent Macos command to the linux:
sudo iptables -t nat -A POSTROUTING -o en0 -j MASQUERADE
The reason i want to do this is I have a VPN that has the default route, but i ...
- 269
1
vote
0
answers
252
views
How to route traffic out a non-standard interface using pfctl on macos?
I have a VPN which has setup a default route, which is (of course) different to my gateway. All my traffic therefore gets routed through the tunnel.
however i would like to exempt certain apps from ...
- 269
1
vote
1
answer
263
views
Why does Docker require udp ports to function - Can I disable this?
I came across strange behaviour with docker, where I tried to block all external UDP incoming & outgoing connections except for DNS (see mac pf config below) which breaks my docker containers.
...
- 111
1
vote
0
answers
582
views
Using pfctl to add firewall rules at runtime WITHOUT editing /etc/pf.conf?
I have an OSX app that (while it is running and only while it is running) needs to make changes to the OSX packet filter (pf) so that it blocks or allows certain traffic. These rules should be in ...
- 269
0
votes
1
answer
554
views
pf firewall blocks raspbian apt-get update
I am connecting my raspberry pi 3(raspbian stretch) to my Macpro(10.13.2; High Sierra) to 802.3 ethernet port which is a part of bridged adapter (bridge100) using Internet Share feature. Internet ...
- 2,078
1
vote
1
answer
2k
views
Allow Samba connections *only* from internal LAN (PF firewall)?
There is a FreeBSD 11.1-RELEASE machine with only 1 NIC, serving Samba shares behind a PF firewall on same server.
I need to allow connections only from clients connecting from the internal network (/...
- 217
1
vote
1
answer
2k
views
How to configure the router between two different internal network in Virtualbox?
I would like to build this network in Virtualbox:
I use OpenBSD for routers, this OS is pretty easy,and well commented to configure, however I still got one problem. Router named router02 can access ...
- 11
1
vote
0
answers
590
views
Mac receiving ICMP requests but not sending any replies
Why could my osx machine be receiving ICMP requests (that I'm sending), but not returning any replies?
$ sudo tcpdump -nni any icmp
tcpdump: data link type PKTAP
tcpdump: verbose output suppressed, ...
- 121
2
votes
1
answer
159
views
Disable OSX kernel space TCP handling
I'm writing a partial reimplementation of TCP for learning purposes, using Scapy. My TCP server.py does not get the chance to respond to SYN messages sent to it because the kernel responds to them ...
- 121
4
votes
1
answer
2k
views
PF on macOS Sierra doesn't seem to be reading ApplicationFirewall
I have PF working but when I start/restart the system the postfix 'master' program asks me if I want to grant permission to it to accept connections from the internet.
Now, permission is set in the ...
- 163
1
vote
2
answers
2k
views
PF on macOS Sierra is blocking some local network traffic, allowing other
I have pf - running on my Mac Mini 2012, under OSX 10.12.2. Except for some oddities. I can talk to the Wireless network printer, but I cant talk to the HP 2015 on the ethernet. Internet is fine. ...
- 163
1
vote
0
answers
32
views
Why is address family mandatory when using icmp with pf?
there.
I wasn't able to find the answer for this question: when creating an ICMP pf rule, I must tell it's inet or inet6 address family; I would like to know why, as proto icmp is for inet and proto ...
- 11
4
votes
2
answers
1k
views
In pf, why can IPv6 be specified as a 'protocol' as well as an address family?
In the pf firewall, the pf.conf man page 'parameters' section states that "protocol" is anything from /etc/protocols, and that it's distinct from "address family" ("<af>") which is inet or inet6....
- 1,625
4
votes
2
answers
8k
views
How to make a VPN kill-switch for mac OS X
What I wanna do is to have the internet connection disabled completely when the VPN connection goes down. I am connecting to my VPN (privatevpn.com) through Viscosity.
I have tried everything in the ...
- 41
1
vote
1
answer
1k
views
NAT for a local device on pfSense - what am I missing?
I have an old and odd 1980s device (it's part of an early controller I've had for ages).
It has a hard-coded address of 192.168.1.100 and apparently (perhaps because of its age) it expects to have a ...
- 1,625
2
votes
1
answer
585
views
redirect 127.0.0.2:80 to 127.0.0.1:3000 using pfctl
Background
I'm trying to make a redirection setup to make it so that when I make a request to example.com it would be redirected to 127.0.0.1:3000.
I know that I can map example.com to 127.0.0.2 via ...
- 135
1
vote
0
answers
161
views
Mac OS X firewall settings
I'm having some issues with setting up firewall on Mac OS X El Capitan version 10.11.4.
I have number of network interfaces including en3, which is my main ethernet connection and and gif0 which is ...
- 11
1
vote
0
answers
72
views
Mac OSX proxying
On my mac (OS X Mavericks), I am trying to redirect all the outgoing calls to a server (192.168.1.2) to a proxy server (192.168.1.3). I am using the following command (assuming that I don't need any ...
- 111
1
vote
0
answers
223
views
bsd (osx) pf nat - change source port on outgoing UDP packets
I am running docker-machine on osx. docker-machine is running NAT so when my container send out a UDP packet on port 1812, NAT is translating it to some random port.
I am playing around with pf nat (...
- 111
27
votes
2
answers
24k
views
pf error - "No ALTQ support in the kernel"... What does this mean?
I am running Mac OS X. I would like to be able to configure pf because it seems to be more sophisticated and flexible than the default Mac OS X firewall that you can access through the System ...
- 473
2
votes
0
answers
135
views
Bind apps to VPN network interface with group based routing policies
My goal is to bind some applications to a specific network interface (tun0). I believe my best option would be that of creating special routing rules for applications launched with a specific group (...
- 21
3
votes
0
answers
1k
views
How to block a port from all traffic on all interfaces in Mac OS X 10.10.5 (Yosemite)
I need to block port 27017 to do some testing but I can’t seem to figure out how to do it in Mac OS X 10.10.5 (Yosemite). I know that sometime ago they moved from iptables to pf tables, but the ...
- 131
1
vote
2
answers
3k
views
PF firewall: How to disable all filtering on loopback interface EXCEPT specific port forwarding rules?
PF question on OS X Yosemite 10.10.4:
I know that set skip on lo0 disables all filtering (nat and redirects) on lo0, but what if I need to save the httpd port forwarding rules on this interface while ...
- 2,078
6
votes
1
answer
3k
views
OSX 10.11 (El Capitan beta) pf.conf behaviour changed?
I kind of expected things to break, but ...
My pf forwarding rules, which worked previously on Yosemite, no longer work on 10.11.
My forwarding rule is as follows: rdr pass on lo0 inet proto tcp ...
- 182
1
vote
0
answers
964
views
How to route traffic through two different network adapters based on TCP port in OS X
(cross-posting from ServerFault, as this forum seems more appropriate for this question)
I have a scenario where we will be using a Mac to stream video content to an RTMP server. This RMTP service ...
- 111
0
votes
1
answer
329
views
OS X OpenVPN packet filtering
I currently have an OpenVPN connection running on my Mac. By default, all of my network traffic is currently being routed through this connection: http, ssh, etc. I'm attempting to use packet ...
- 101
1
vote
1
answer
2k
views
PF: Can't open port on OS X
Have troubles opening the port 9 on os x 10.10.3 yousemite using pf firewall. I want to do this for being able to get wake-on-lan packets to this port. I assume that for WoL to work the port (on the ...
- 2,078
1
vote
0
answers
324
views
How do I intercept HTTP traffic on OS X?
I saw this tutorial: http://www.ex-parrot.com/pete/upside-down-ternet.html and I tried to implement a part of it on OS X 10.10. One command used there is
iptables -A PREROUTING -s 192.168.0.0/255....
- 111
0
votes
1
answer
453
views
Timeout on some connections (OpenBSD/PF with NAT)
I am getting "ERR_CONNECTION_TIMEOUT" on chrome for certain sites only (e.g. www.lemonde.fr). This does not happen when I use a proxy or if I access the site from my firewall.
For the context, I use ...
- 1
0
votes
2
answers
1k
views
Block ICMP flood from a specific IP with pf
I'm getting a lot of ICMP throttle messages in my system.log:
Apr 11 20:45:28 kernel[0]: Limiting icmp unreach response from 1054 to 250 packets per second
Apr 11 20:45:29 kernel[0]: Limiting icmp ...
- 103
2
votes
1
answer
2k
views
PF rule using return-rst on Mac OS X does not reply with TCP reset
I'm trying to add a simple PF rule:
block return-rst out proto tcp from any to any port 33128
to filter all outgoing traffic to TCP port 33128, and I'd like it to respond with a reset. However, when ...
- 121
1
vote
0
answers
128
views
How can one redirect to a new host all traffic destined for an old host?
We're moving a bunch of services, say from 1.2.3.4 to 5.6.7.8.
In order to test that the new services are correctly configured, we'd like to redirect (to the new host) all traffic destined for the ...
- 166
6
votes
1
answer
2k
views
How to use new keyword dummynet-anchor in pf.conf of Mac OS X
Mac OS X introduced a new keyword “dummynet-anchor” in pf.conf file, which not used in FreeBSD and OpenBSD. The ipfw was removed in Mac OS X 10.10, How to use “dummynet-anchor”?
UPDATE:
What portion ...
- 63
3
votes
0
answers
2k
views
Port forwarding outgoing request with PF
I'm trying to redirect all outgoing traffic from my local machine on port 843, to go to my local service on port 1234.
So, when I make a request to e.g. 1.2.3.4:843, I want it to connect to 127.0.0.1:...
- 131
5
votes
1
answer
7k
views
limiting upload bandwidth in Mac OS X Yosemite (10.10)
I have ADSL internet, and when there is an application uploading to the Internet at full speed (e.g. Skype or Chrome during file uploads), the download bandwidth becomes very very slow. Meaning I ...
- 515
1
vote
1
answer
1k
views
OS X, packet filter (PF), route-to options
I was trying to setup "policy based" routing with pfctl (PF) on OS X 10.10, however no matter what i do, i am getting "syntax error" from pfctl. config is rather simple:
cat ./test.conf
inf="en0"
...
- 31
0
votes
1
answer
2k
views
Share internet as Bridge instead as a Router using PFCTL (OS X)?
I've got an Airport Time Capsule (TC) and a Macbook Air (MBA) and another PC.
The MBA connects the TC wirelessly while the PC connects to the MBA with Ethernet cable.
The problem:
The MBA takes the ...
- 2,424
0
votes
1
answer
536
views
OpenBSD: Prioritizing empty ACKs
There is a wildly used example concerning PF and prioritising empty ACK packets, so that an an asynchronous connections' downstream does not lose performance, if the upstream is clogged up.
The ...
0
votes
1
answer
4k
views
Equivalent iptables command on OS X 10.9
I want to redirect the tcp traffic temporarily to a custom port. On Linux, I use the following command:
iptables -t nat -A OUTPUT -p tcp --dport 1935 -m owner \! --uid-owner root -j REDIRECT
and to ...
- 103
0
votes
1
answer
2k
views
allow SSH to bypass VPN on OSX mavericks, openvpn, pf
My home computer connects to the internet through an OpenVPN connection. However, I would like to be able to connect to my home computer from outside over ssh. Ssh is set up and working, but when I ...
- 1
0
votes
1
answer
142
views
how to access a range of public IPs only through a VPN?
For security reasons, I am not supposed to access an otherwise public IP range unless a VPN is up. However, if my VPN is down, my system routes to the IP anyway, which is a breach of my obligations. ...
- 139