Questions tagged [pf]

A stateful firewall program, common on BSD systems and also available on others.

Filter by
Sorted by
Tagged with
0
votes
0answers
35 views

Configure PF syslog messages

Is it possible to configure the syslog messages sent by pf? I am using an OPNsense as well as a PFsense and configure descriptions (e.g. "DNS to external") to each rule. The syslog messages ...
0
votes
1answer
384 views

Port forwarding and NAT using pf on freebsd

I have a network router that connects three networks with the outside world. One of the internal networks is public facing the other two are not and connected via NAT. I am part of a larger network ...
0
votes
1answer
193 views

Override "set skip on lo0" for PF firewall

I am using PF firewall and I want to redirect port on loopback interface, like this: rdr on lo0 inet proto tcp from 127.0.0.1 to 127.0.0.1 port 443 -> 127.0.0.1 port 6443 The problem is, my VPN ...
2
votes
1answer
3k views

macos Catalina - Packet Filter (pf) firewall - how to restrict www access to a specific IP address on local network?

I am trying to use pf firewall on macos Catalina 10.15.3 to allow www (80,443) access for a specific local IP address on my home network. This local IP address will request web pages from a nginx ...
0
votes
2answers
724 views

Mac OSX: How to forward all outgoing traffic to specific host/port to different host/port?

I've been searching high and low for days and I'm 100% stuck with PF. Essentially I want to take all of my local, outbound traffic to ip/port redirect it to a different ip/port. local application ...
2
votes
1answer
295 views

pfctl divert-socket in mac os?

I'm messing with divert sockets in OSX, and in order to capture any socket, I first need to set up a firewall redirection (divertion if you will): ipfw add divert 3282 tcp from any to any Something ...
4
votes
1answer
2k views

How to do IP masquerading on MacOS 10.14+?

I am looking for the equivalent Macos command to the linux: sudo iptables -t nat -A POSTROUTING -o en0 -j MASQUERADE The reason i want to do this is I have a VPN that has the default route, but i ...
1
vote
0answers
139 views

How to route traffic out a non-standard interface using pfctl on macos?

I have a VPN which has setup a default route, which is (of course) different to my gateway. All my traffic therefore gets routed through the tunnel. however i would like to exempt certain apps from ...
1
vote
1answer
187 views

Why does Docker require udp ports to function - Can I disable this?

I came across strange behaviour with docker, where I tried to block all external UDP incoming & outgoing connections except for DNS (see mac pf config below) which breaks my docker containers. ...
1
vote
0answers
289 views

Using pfctl to add firewall rules at runtime WITHOUT editing /etc/pf.conf?

I have an OSX app that (while it is running and only while it is running) needs to make changes to the OSX packet filter (pf) so that it blocks or allows certain traffic. These rules should be in ...
0
votes
1answer
423 views

pf firewall blocks raspbian apt-get update

I am connecting my raspberry pi 3(raspbian stretch) to my Macpro(10.13.2; High Sierra) to 802.3 ethernet port which is a part of bridged adapter (bridge100) using Internet Share feature. Internet ...
1
vote
1answer
2k views

Allow Samba connections *only* from internal LAN (PF firewall)?

There is a FreeBSD 11.1-RELEASE machine with only 1 NIC, serving Samba shares behind a PF firewall on same server. I need to allow connections only from clients connecting from the internal network (/...
0
votes
1answer
2k views

How to configure the router between two different internal network in Virtualbox?

I would like to build this network in Virtualbox: I use OpenBSD for routers, this OS is pretty easy,and well commented to configure, however I still got one problem. Router named router02 can access ...
1
vote
0answers
501 views

Mac receiving ICMP requests but not sending any replies

Why could my osx machine be receiving ICMP requests (that I'm sending), but not returning any replies? $ sudo tcpdump -nni any icmp tcpdump: data link type PKTAP tcpdump: verbose output suppressed, ...
2
votes
1answer
158 views

Disable OSX kernel space TCP handling

I'm writing a partial reimplementation of TCP for learning purposes, using Scapy. My TCP server.py does not get the chance to respond to SYN messages sent to it because the kernel responds to them ...
4
votes
1answer
1k views

PF on macOS Sierra doesn't seem to be reading ApplicationFirewall

I have PF working but when I start/restart the system the postfix 'master' program asks me if I want to grant permission to it to accept connections from the internet. Now, permission is set in the ...
1
vote
2answers
2k views

PF on macOS Sierra is blocking some local network traffic, allowing other

I have pf - running on my Mac Mini 2012, under OSX 10.12.2. Except for some oddities. I can talk to the Wireless network printer, but I cant talk to the HP 2015 on the ethernet. Internet is fine. ...
1
vote
0answers
25 views

Why is address family mandatory when using icmp with pf?

there. I wasn't able to find the answer for this question: when creating an ICMP pf rule, I must tell it's inet or inet6 address family; I would like to know why, as proto icmp is for inet and proto ...
3
votes
2answers
808 views

In pf, why can IPv6 be specified as a 'protocol' as well as an address family?

In the pf firewall, the pf.conf man page 'parameters' section states that "protocol" is anything from /etc/protocols, and that it's distinct from "address family" ("<af>") which is inet or inet6....
3
votes
2answers
7k views

How to make a VPN kill-switch for mac OS X

What I wanna do is to have the internet connection disabled completely when the VPN connection goes down. I am connecting to my VPN (privatevpn.com) through Viscosity. I have tried everything in the ...
1
vote
1answer
1k views

NAT for a local device on pfSense - what am I missing?

I have an old and odd 1980s device (it's part of an early controller I've had for ages). It has a hard-coded address of 192.168.1.100 and apparently (perhaps because of its age) it expects to have a ...
2
votes
1answer
459 views

redirect 127.0.0.2:80 to 127.0.0.1:3000 using pfctl

Background I'm trying to make a redirection setup to make it so that when I make a request to example.com it would be redirected to 127.0.0.1:3000. I know that I can map example.com to 127.0.0.2 via ...
1
vote
0answers
155 views

Mac OS X firewall settings

I'm having some issues with setting up firewall on Mac OS X El Capitan version 10.11.4. I have number of network interfaces including en3, which is my main ethernet connection and and gif0 which is ...
1
vote
0answers
67 views

Mac OSX proxying

On my mac (OS X Mavericks), I am trying to redirect all the outgoing calls to a server (192.168.1.2) to a proxy server (192.168.1.3). I am using the following command (assuming that I don't need any ...
1
vote
0answers
182 views

bsd (osx) pf nat - change source port on outgoing UDP packets

I am running docker-machine on osx. docker-machine is running NAT so when my container send out a UDP packet on port 1812, NAT is translating it to some random port. I am playing around with pf nat (...
25
votes
2answers
18k views

pf error - "No ALTQ support in the kernel"... What does this mean?

I am running Mac OS X. I would like to be able to configure pf because it seems to be more sophisticated and flexible than the default Mac OS X firewall that you can access through the System ...
2
votes
0answers
79 views

Bind apps to VPN network interface with group based routing policies

My goal is to bind some applications to a specific network interface (tun0). I believe my best option would be that of creating special routing rules for applications launched with a specific group (...
3
votes
0answers
1k views

How to block a port from all traffic on all interfaces in Mac OS X 10.10.5 (Yosemite)

I need to block port 27017 to do some testing but I can’t seem to figure out how to do it in Mac OS X 10.10.5 (Yosemite). I know that sometime ago they moved from iptables to pf tables, but the ...
1
vote
2answers
3k views

PF firewall: How to disable all filtering on loopback interface EXCEPT specific port forwarding rules?

PF question on OS X Yosemite 10.10.4: I know that set skip on lo0 disables all filtering (nat and redirects) on lo0, but what if I need to save the httpd port forwarding rules on this interface while ...
6
votes
1answer
3k views

OSX 10.11 (El Capitan beta) pf.conf behaviour changed?

I kind of expected things to break, but ... My pf forwarding rules, which worked previously on Yosemite, no longer work on 10.11. My forwarding rule is as follows: rdr pass on lo0 inet proto tcp ...
1
vote
0answers
795 views

How to route traffic through two different network adapters based on TCP port in OS X

(cross-posting from ServerFault, as this forum seems more appropriate for this question) I have a scenario where we will be using a Mac to stream video content to an RTMP server. This RMTP service ...
0
votes
1answer
280 views

OS X OpenVPN packet filtering

I currently have an OpenVPN connection running on my Mac. By default, all of my network traffic is currently being routed through this connection: http, ssh, etc. I'm attempting to use packet ...
1
vote
1answer
1k views

PF: Can't open port on OS X

Have troubles opening the port 9 on os x 10.10.3 yousemite using pf firewall. I want to do this for being able to get wake-on-lan packets to this port. I assume that for WoL to work the port (on the ...
1
vote
0answers
167 views

How do I intercept HTTP traffic on OS X?

I saw this tutorial: http://www.ex-parrot.com/pete/upside-down-ternet.html and I tried to implement a part of it on OS X 10.10. One command used there is iptables -A PREROUTING -s 192.168.0.0/255....
0
votes
1answer
414 views

Timeout on some connections (OpenBSD/PF with NAT)

I am getting "ERR_CONNECTION_TIMEOUT" on chrome for certain sites only (e.g. www.lemonde.fr). This does not happen when I use a proxy or if I access the site from my firewall. For the context, I use ...
0
votes
2answers
900 views

Block ICMP flood from a specific IP with pf

I'm getting a lot of ICMP throttle messages in my system.log: Apr 11 20:45:28 kernel[0]: Limiting icmp unreach response from 1054 to 250 packets per second Apr 11 20:45:29 kernel[0]: Limiting icmp ...
2
votes
1answer
2k views

PF rule using return-rst on Mac OS X does not reply with TCP reset

I'm trying to add a simple PF rule: block return-rst out proto tcp from any to any port 33128 to filter all outgoing traffic to TCP port 33128, and I'd like it to respond with a reset. However, when ...
1
vote
0answers
119 views

How can one redirect to a new host all traffic destined for an old host?

We're moving a bunch of services, say from 1.2.3.4 to 5.6.7.8. In order to test that the new services are correctly configured, we'd like to redirect (to the new host) all traffic destined for the ...
6
votes
1answer
2k views

How to use new keyword dummynet-anchor in pf.conf of Mac OS X

Mac OS X introduced a new keyword “dummynet-anchor” in pf.conf file, which not used in FreeBSD and OpenBSD. The ipfw was removed in Mac OS X 10.10, How to use “dummynet-anchor”? UPDATE: What portion ...
3
votes
0answers
2k views

Port forwarding outgoing request with PF

I'm trying to redirect all outgoing traffic from my local machine on port 843, to go to my local service on port 1234. So, when I make a request to e.g. 1.2.3.4:843, I want it to connect to 127.0.0.1:...
5
votes
1answer
7k views

limiting upload bandwidth in Mac OS X Yosemite (10.10)

I have ADSL internet, and when there is an application uploading to the Internet at full speed (e.g. Skype or Chrome during file uploads), the download bandwidth becomes very very slow. Meaning I ...
1
vote
1answer
1k views

OS X, packet filter (PF), route-to options

I was trying to setup "policy based" routing with pfctl (PF) on OS X 10.10, however no matter what i do, i am getting "syntax error" from pfctl. config is rather simple: cat ./test.conf inf="en0" ...
0
votes
1answer
2k views

Share internet as Bridge instead as a Router using PFCTL (OS X)?

I've got an Airport Time Capsule (TC) and a Macbook Air (MBA) and another PC. The MBA connects the TC wirelessly while the PC connects to the MBA with Ethernet cable. The problem: The MBA takes the ...
0
votes
1answer
503 views

OpenBSD: Prioritizing empty ACKs

There is a wildly used example concerning PF and prioritising empty ACK packets, so that an an asynchronous connections' downstream does not lose performance, if the upstream is clogged up. The ...
0
votes
1answer
4k views

Equivalent iptables command on OS X 10.9

I want to redirect the tcp traffic temporarily to a custom port. On Linux, I use the following command: iptables -t nat -A OUTPUT -p tcp --dport 1935 -m owner \! --uid-owner root -j REDIRECT and to ...
0
votes
1answer
1k views

allow SSH to bypass VPN on OSX mavericks, openvpn, pf

My home computer connects to the internet through an OpenVPN connection. However, I would like to be able to connect to my home computer from outside over ssh. Ssh is set up and working, but when I ...
0
votes
1answer
140 views

how to access a range of public IPs only through a VPN?

For security reasons, I am not supposed to access an otherwise public IP range unless a VPN is up. However, if my VPN is down, my system routes to the IP anyway, which is a breach of my obligations. ...
0
votes
1answer
2k views

Configure Packet Filter with white-list and black-list

I’m trying to configure Packet Filter on a FreeBSD server with a black-list of addresses/networks to block and a white-list of trusted users which cannot be blocked (black-listed). Here is my first ...
0
votes
1answer
635 views

OpenBSD pf Egress Filtering

I am attempting to build a simple pf.conf which includes NAT allowing traffic out of the network from all systems on a select series of ports. In my basic configuration I have an internal server that ...
0
votes
2answers
978 views

Packet filter logging [currently with tcpdump in background as root]

I am running OS X Mavericks and use the "packet filter" firewall. However, it seems that "pflogd" is not available. I found that you can create an interface named pflog0 and then use tcpdump to see ...