Skip to main content

Questions tagged [pf]

A stateful firewall program, common on BSD systems and also available on others.

Filter by
Sorted by
Tagged with
0 votes
1 answer
49 views

Using ipfw and pf together

I would like to use pf and ipfw at the same time for different tasks, but I can not understand who is activated first (if there is an order) when a rule is received. Also trying to verify this, I can’...
usernew's user avatar
0 votes
0 answers
50 views

Allow connection to modem dashboard in pf firewall

I am using Murus to manage the rules of my macos pf firewall. My approach is to block everything by default and allow only what I need. This has worked well so far, with one exception: I cannot seem ...
KenMatsuo's user avatar
1 vote
1 answer
276 views

How can I start the PF service without interrupting existing connections?

I have an Ansible playbook that starts the PF firewall. It freezes at this point because the SSH connection between the target and the host Ansible is executing on is interrupted as a result of this. ...
Ken - Enough about Monica's user avatar
1 vote
2 answers
382 views

FreeBSD pf.conf. Error: "no IP address found for wlan0:network"

Every time I try to make some sensible pf rules - I fail. Need someone to help me with the puzzling syntax and mechanics of pf. Here is my pf.conf: 1 # The name of our network interface as seen in `...
user14063792468's user avatar
2 votes
1 answer
1k views

My network setup do not work. FreeBSD

This question was asked by me on serverfault.com. It was closed as off-topic, with a suggestion to ask here, on superuser. The OS is FreeBSD 13.0. The setup that I need to establish is simple. In ...
user14063792468's user avatar
0 votes
1 answer
3k views

Port forwarding and NAT using pf on freebsd

I have a network router that connects three networks with the outside world. One of the internal networks is public facing the other two are not and connected via NAT. I am part of a larger network ...
Sim's user avatar
  • 203
0 votes
1 answer
745 views

Override "set skip on lo0" for PF firewall

I am using PF firewall and I want to redirect port on loopback interface, like this: rdr on lo0 inet proto tcp from 127.0.0.1 to 127.0.0.1 port 443 -> 127.0.0.1 port 6443 The problem is, my VPN ...
bmk's user avatar
  • 103
2 votes
0 answers
4k views

Packet Filter (pf) firewall in macOS Catalina: How to restrict www access to a specific IP address on local network?

I am trying to use pf firewall on macos Catalina 10.15.3 to allow www (80,443) access for a specific local IP address on my home network. This local IP address will request web pages from a nginx ...
dcs3spp's user avatar
  • 121
1 vote
2 answers
2k views

Mac OSX: How to forward all outgoing traffic to specific host/port to different host/port?

I've been searching high and low for days and I'm 100% stuck with PF. Essentially I want to take all of my local, outbound traffic to ip/port redirect it to a different ip/port. local application ...
Mikhail Karpych's user avatar
2 votes
1 answer
525 views

pfctl divert-socket in mac os?

I'm messing with divert sockets in OSX, and in order to capture any socket, I first need to set up a firewall redirection (divertion if you will): ipfw add divert 3282 tcp from any to any Something ...
toti's user avatar
  • 121
4 votes
1 answer
3k views

How to do IP masquerading on MacOS 10.14+?

I am looking for the equivalent Macos command to the linux: sudo iptables -t nat -A POSTROUTING -o en0 -j MASQUERADE The reason i want to do this is I have a VPN that has the default route, but i ...
horseyguy's user avatar
  • 269
1 vote
0 answers
407 views

How to route traffic out a non-standard interface using pfctl on macos?

I have a VPN which has setup a default route, which is (of course) different to my gateway. All my traffic therefore gets routed through the tunnel. however i would like to exempt certain apps from ...
horseyguy's user avatar
  • 269
1 vote
1 answer
331 views

Why does Docker require udp ports to function - Can I disable this?

I came across strange behaviour with docker, where I tried to block all external UDP incoming & outgoing connections except for DNS (see mac pf config below) which breaks my docker containers. ...
Don's user avatar
  • 111
1 vote
0 answers
944 views

Using pfctl to add firewall rules at runtime WITHOUT editing /etc/pf.conf?

I have an OSX app that (while it is running and only while it is running) needs to make changes to the OSX packet filter (pf) so that it blocks or allows certain traffic. These rules should be in ...
horseyguy's user avatar
  • 269
0 votes
1 answer
656 views

pf firewall blocks raspbian apt-get update

I am connecting my raspberry pi 3(raspbian stretch) to my Macpro(10.13.2; High Sierra) to 802.3 ethernet port which is a part of bridged adapter (bridge100) using Internet Share feature. Internet ...
drew1kun's user avatar
  • 2,157
1 vote
1 answer
3k views

Allow Samba connections *only* from internal LAN (PF firewall)?

There is a FreeBSD 11.1-RELEASE machine with only 1 NIC, serving Samba shares behind a PF firewall on same server. I need to allow connections only from clients connecting from the internal network (/...
gsl's user avatar
  • 227
1 vote
1 answer
2k views

How to configure the router between two different internal network in Virtualbox?

I would like to build this network in Virtualbox: I use OpenBSD for routers, this OS is pretty easy,and well commented to configure, however I still got one problem. Router named router02 can access ...
Balázs Izsóf's user avatar
1 vote
0 answers
638 views

Mac receiving ICMP requests but not sending any replies

Why could my osx machine be receiving ICMP requests (that I'm sending), but not returning any replies? $ sudo tcpdump -nni any icmp tcpdump: data link type PKTAP tcpdump: verbose output suppressed, ...
user1071840's user avatar
2 votes
1 answer
165 views

Disable OSX kernel space TCP handling

I'm writing a partial reimplementation of TCP for learning purposes, using Scapy. My TCP server.py does not get the chance to respond to SYN messages sent to it because the kernel responds to them ...
aeb0's user avatar
  • 121
4 votes
1 answer
2k views

PF on macOS Sierra doesn't seem to be reading ApplicationFirewall

I have PF working but when I start/restart the system the postfix 'master' program asks me if I want to grant permission to it to accept connections from the internet. Now, permission is set in the ...
Harry McGovern's user avatar
1 vote
2 answers
3k views

PF on macOS Sierra is blocking some local network traffic, allowing other

I have pf - running on my Mac Mini 2012, under OSX 10.12.2. Except for some oddities. I can talk to the Wireless network printer, but I cant talk to the HP 2015 on the ethernet. Internet is fine. ...
Harry McGovern's user avatar
1 vote
0 answers
69 views

Why is address family mandatory when using icmp with pf?

there. I wasn't able to find the answer for this question: when creating an ICMP pf rule, I must tell it's inet or inet6 address family; I would like to know why, as proto icmp is for inet and proto ...
Penegal's user avatar
  • 11
4 votes
2 answers
1k views

In pf, why can IPv6 be specified as a 'protocol' as well as an address family?

In the pf firewall, the pf.conf man page 'parameters' section states that "protocol" is anything from /etc/protocols, and that it's distinct from "address family" ("<af>") which is inet or inet6....
Stilez's user avatar
  • 1,745
4 votes
2 answers
9k views

How to make a VPN kill-switch for mac OS X

What I wanna do is to have the internet connection disabled completely when the VPN connection goes down. I am connecting to my VPN (privatevpn.com) through Viscosity. I have tried everything in the ...
John Schlong's user avatar
1 vote
1 answer
1k views

NAT for a local device on pfSense - what am I missing?

I have an old and odd 1980s device (it's part of an early controller I've had for ages). It has a hard-coded address of 192.168.1.100 and apparently (perhaps because of its age) it expects to have a ...
Stilez's user avatar
  • 1,745
2 votes
1 answer
667 views

redirect 127.0.0.2:80 to 127.0.0.1:3000 using pfctl

Background I'm trying to make a redirection setup to make it so that when I make a request to example.com it would be redirected to 127.0.0.1:3000. I know that I can map example.com to 127.0.0.2 via ...
ave's user avatar
  • 135
1 vote
0 answers
181 views

Mac OS X firewall settings

I'm having some issues with setting up firewall on Mac OS X El Capitan version 10.11.4. I have number of network interfaces including en3, which is my main ethernet connection and and gif0 which is ...
Sergey's user avatar
  • 11
1 vote
0 answers
76 views

Mac OSX proxying

On my mac (OS X Mavericks), I am trying to redirect all the outgoing calls to a server (192.168.1.2) to a proxy server (192.168.1.3). I am using the following command (assuming that I don't need any ...
neorg's user avatar
  • 111
1 vote
0 answers
261 views

bsd (osx) pf nat - change source port on outgoing UDP packets

I am running docker-machine on osx. docker-machine is running NAT so when my container send out a UDP packet on port 1812, NAT is translating it to some random port. I am playing around with pf nat (...
roocell's user avatar
  • 111
27 votes
2 answers
28k views

pf error - "No ALTQ support in the kernel"... What does this mean?

I am running Mac OS X. I would like to be able to configure pf because it seems to be more sophisticated and flexible than the default Mac OS X firewall that you can access through the System ...
Zen Hacker's user avatar
2 votes
0 answers
155 views

Bind apps to VPN network interface with group based routing policies

My goal is to bind some applications to a specific network interface (tun0). I believe my best option would be that of creating special routing rules for applications launched with a specific group (...
user522621's user avatar
3 votes
0 answers
1k views

How to block a port from all traffic on all interfaces in Mac OS X 10.10.5 (Yosemite)

I need to block port 27017 to do some testing but I can’t seem to figure out how to do it in Mac OS X 10.10.5 (Yosemite). I know that sometime ago they moved from iptables to pf tables, but the ...
Jack Slingerland's user avatar
1 vote
2 answers
3k views

PF firewall: How to disable all filtering on loopback interface EXCEPT specific port forwarding rules?

PF question on OS X Yosemite 10.10.4: I know that set skip on lo0 disables all filtering (nat and redirects) on lo0, but what if I need to save the httpd port forwarding rules on this interface while ...
drew1kun's user avatar
  • 2,157
6 votes
1 answer
3k views

OSX 10.11 (El Capitan beta) pf.conf behaviour changed?

I kind of expected things to break, but ... My pf forwarding rules, which worked previously on Yosemite, no longer work on 10.11. My forwarding rule is as follows: rdr pass on lo0 inet proto tcp ...
Tyler Sebastian's user avatar
1 vote
0 answers
1k views

How to route traffic through two different network adapters based on TCP port in OS X

(cross-posting from ServerFault, as this forum seems more appropriate for this question) I have a scenario where we will be using a Mac to stream video content to an RTMP server. This RMTP service ...
Luis Delgado's user avatar
0 votes
1 answer
352 views

OS X OpenVPN packet filtering

I currently have an OpenVPN connection running on my Mac. By default, all of my network traffic is currently being routed through this connection: http, ssh, etc. I'm attempting to use packet ...
alex-phillips's user avatar
1 vote
1 answer
2k views

PF: Can't open port on OS X

Have troubles opening the port 9 on os x 10.10.3 yousemite using pf firewall. I want to do this for being able to get wake-on-lan packets to this port. I assume that for WoL to work the port (on the ...
drew1kun's user avatar
  • 2,157
1 vote
0 answers
387 views

How do I intercept HTTP traffic on OS X?

I saw this tutorial: http://www.ex-parrot.com/pete/upside-down-ternet.html and I tried to implement a part of it on OS X 10.10. One command used there is iptables -A PREROUTING -s 192.168.0.0/255....
Petru's user avatar
  • 111
0 votes
1 answer
513 views

Timeout on some connections (OpenBSD/PF with NAT)

I am getting "ERR_CONNECTION_TIMEOUT" on chrome for certain sites only (e.g. www.lemonde.fr). This does not happen when I use a proxy or if I access the site from my firewall. For the context, I use ...
KuroNeko's user avatar
1 vote
2 answers
1k views

Block ICMP flood from a specific IP with pf

I'm getting a lot of ICMP throttle messages in my system.log: Apr 11 20:45:28 kernel[0]: Limiting icmp unreach response from 1054 to 250 packets per second Apr 11 20:45:29 kernel[0]: Limiting icmp ...
owenfi's user avatar
  • 123
2 votes
1 answer
2k views

PF rule using return-rst on Mac OS X does not reply with TCP reset

I'm trying to add a simple PF rule: block return-rst out proto tcp from any to any port 33128 to filter all outgoing traffic to TCP port 33128, and I'd like it to respond with a reset. However, when ...
ldx's user avatar
  • 121
1 vote
0 answers
136 views

How can one redirect to a new host all traffic destined for an old host?

We're moving a bunch of services, say from 1.2.3.4 to 5.6.7.8. In order to test that the new services are correctly configured, we'd like to redirect (to the new host) all traffic destined for the ...
eggyal's user avatar
  • 166
7 votes
1 answer
2k views

How to use new keyword dummynet-anchor in pf.conf of Mac OS X

Mac OS X introduced a new keyword “dummynet-anchor” in pf.conf file, which not used in FreeBSD and OpenBSD. The ipfw was removed in Mac OS X 10.10, How to use “dummynet-anchor”? UPDATE: What portion ...
Yaocl's user avatar
  • 73
3 votes
1 answer
3k views

Port forwarding outgoing request with PF

I'm trying to redirect all outgoing traffic from my local machine on port 843, to go to my local service on port 1234. So, when I make a request to e.g. 1.2.3.4:843, I want it to connect to 127.0.0.1:...
Alexander Olsson's user avatar
5 votes
1 answer
7k views

limiting upload bandwidth in Mac OS X Yosemite (10.10)

I have ADSL internet, and when there is an application uploading to the Internet at full speed (e.g. Skype or Chrome during file uploads), the download bandwidth becomes very very slow. Meaning I ...
psmith's user avatar
  • 515
1 vote
1 answer
1k views

OS X, packet filter (PF), route-to options

I was trying to setup "policy based" routing with pfctl (PF) on OS X 10.10, however no matter what i do, i am getting "syntax error" from pfctl. config is rather simple: cat ./test.conf inf="en0" ...
Ostap's user avatar
  • 41
0 votes
1 answer
2k views

Share internet as Bridge instead as a Router using PFCTL (OS X)?

I've got an Airport Time Capsule (TC) and a Macbook Air (MBA) and another PC. The MBA connects the TC wirelessly while the PC connects to the MBA with Ethernet cable. The problem: The MBA takes the ...
johni's user avatar
  • 2,434
1 vote
1 answer
576 views

OpenBSD: Prioritizing empty ACKs

There is a wildly used example concerning PF and prioritising empty ACK packets, so that an an asynchronous connections' downstream does not lose performance, if the upstream is clogged up. The ...
Laurel Wolf's user avatar
0 votes
1 answer
4k views

Equivalent iptables command on OS X 10.9

I want to redirect the tcp traffic temporarily to a custom port. On Linux, I use the following command: iptables -t nat -A OUTPUT -p tcp --dport 1935 -m owner \! --uid-owner root -j REDIRECT and to ...
shobhu's user avatar
  • 103
0 votes
1 answer
2k views

allow SSH to bypass VPN on OSX mavericks, openvpn, pf

My home computer connects to the internet through an OpenVPN connection. However, I would like to be able to connect to my home computer from outside over ssh. Ssh is set up and working, but when I ...
zycho42's user avatar