PF - OSX (OpenBSD) Firewall

Resources

Using pfctl

These are the flags used in the exampe commands below:

v Verbose output
f Load rules from a file
n Parse rules, don't apply
e Enable the packet filter
d Disable the packet filter

Dry run:

pfctl -nvf /path/to/some.conf

Note: The f flag has to be last in the list in the above example. It's taking the path the follows as its argument.

If there were no syntax errors, apply the rules:

pfctl -evf /path/to/some.conf

This, I think, just disables the firewall:

sudo pfctl -d

Flush all filter parameters and reload the default rules, /etc/pf.conf:

pfctl -F all -f /etc/pf.conf

PF rules

Ordering

You need to order your declaration in this order:

Options -- tune the behaviour of the packet filtering engine
Normalization -- protects internal machines against inconsistencies in Internet protocols and implementations
Queueing -- provides rule-based bandwidth control
Translation -- specify how addresses are to be mapped or redirected to other addresses
Filtering -- provides rule-based blocking or passing of packets

I believe it's possible to disable the enforcement of ordering, but if you do that your rules probably won't work the way you want.

Macros

Macros can be defined that will later be expanded in context. Macro names must start with a letter, and may contain letters, digits and underscores. Macro names may not be reserved words (for example pass, in, out). Macros are not expanded inside quotes.

# Define an external interface to use in the following rules
ext_if = "en0"
pass in on $ext_if proto tcp from any to any port 25

Anchors

Anchors are containers that can hold rules, address tables, and other anchors.

nat-anchor - nat rules
rdr-anchor - rdr rules
binat-anchor - binat rules
anchor - filter rules

rdr-anchor "example"
load anchor "example" from "path/to/example.rule"

Tables

When you define a table you can specify:

persist - keep the table after there are no rules using
const - table cannot be added to or have items removed

table <block> persist

flackend/PF - OSX (OpenBSD) Firewall.md