Firewall setting notes using PFCTL not IPFW on OS X

Block VNC ARD.md

Referencing this discussion on how to deny loopback access, create the opposite which is to only allow access from localhost. The goal is to only allow access after the client has connected with SSH using the port tunneling option.

Add new filter rules to block VNC (port 5900) access when not connected via SSH with port forwarding. Plus add blocks to file sharing (SMB and AFP). Just in case I am running a web server block that too, or any other ports listed in this link.

# pfctl is the packet filter firewall for modern OS X. 
# For more info -> man pfctl
# flush to the default
sudo pfctl -f /etc/pf.conf

# view the current PF rules
sudo pfctl -sr 2>/dev/null

echo 'tunnelPorts = "{ 80, 443, 8080, 5900 }"' > pf_vnc.conf
echo 'doNotSharePorts = "{ 139, 445, 548 }"' >> pf_vnc.conf
echo 'block drop in proto tcp from any to any port $tunnelPorts' >> pf_vnc.conf
echo 'block drop in proto tcp from any to any port $doNotSharePorts' >> pf_vnc.conf

# allow those TCP ports on localhost, assuming client has connected with tunneling
echo 'pass in quick on lo0 proto tcp from any to any port $tunnelPorts' >> pf_vnc.conf

# Now apply all those rules
(sudo pfctl -sr 2>/dev/null; cat pf_vnc.conf) | sudo pfctl -f - 2>/dev/null

Verify the current rules

sudo pfctl -sr 2>/dev/null

# If rules look good. Enable PF if it was not already enabled
sudo pfctl -e

Reset the rules by setting back to the default configuration

sudo pfctl -f /etc/pf.conf

would this help to change the listening ports to just local host? as I am trying to lock it down to local host ? Please
To accomplish VNC over SSH Tunnel
tcp4 0 0 *.5900 . LISTEN
tcp6 0 0 *.5900 . LISTEN

Okay, it does the Job :) even netstat says its listening .. it drops the packet :)