#FIREWALL FOR MAC OS X LION CODE#

RAM is important as pf doesnвЂ™t use swap space. The pf command is limited to one processor, so running a dedicated pf host on an 8 core machine is pretty much overkill. And of course, OpenBSDs pf page is the best source of information on the project, available here. There is a really good post (thanks to for pointing it out) at for syncing the Emerging Threats anchor from. Overall, pfctl is pretty straight forward to use. Once we feel good about the pf configuration, set it to be quiet to keep the logs small and make it a little quicker:ДЄnd to disable pfctl when youвЂ™re done tinkeratinвЂ™: For example, to add a table of 127.0.0.0/24 call localsub:

#FIREWALL FOR MAC OS X LION CODE#

The return code should be something along the lines of the following: Then letвЂ™s set pf to be verbose while weвЂ™re testing (weвЂ™ll turn it off later): Now, provided we donвЂ™t get any crazy errors, letвЂ™s load pf with our rules (which also loads the anchors): Once weвЂ™ve edited our configuration file, letвЂ™s run a quick sanity check on it: You can also build a list, which allows multiple criteria to be defined for a given rule and macros, which are essentially arrays of IPs, ports, etc, designed to reduce the amount of typing you have to do if youвЂ™re building out a big configuration file. Anything in this section of pf.conf in angled () brackets is a table that has been defined. Of the above, tables allow you to define ranges and basically alias IPs. Pass in log quick on en0 proto from any to 192.168.210.10 port 548 keep state One more rule, to show how weвЂ™re going to pass and log data for data coming into en0 for both tcp and udp from anyone to the IP on that interface running 192.168.210.10 for port 548: Then to do something pretty straight forward, like allow incoming icmp traffic for en0: Or to knock the two above lines out with one: First add the following to the pf.conf file to block all otherwise allowed incoming sockets: Then letвЂ™s block some stuff (after all, if weвЂ™re not filtering, why use a packet filter). This is going to always allow local traffic, which we need for a few internal processes. Now letвЂ™s load a line below the previously called anchors in the first file: Here we see information like stats on timeouts, limits to rules, etc.

To see how the rules are interpreted, letвЂ™s run pfctl with the -sa option, which shows all information/stats: The scrub options are pretty cool as it cleans dirty packets prior to passing them to their destination. These are mostly just allowing the Apple services to work with services enabled in the Sharing system preference pane, etc. Load anchor '400.AdaptiveFirewall/' from '/Applications/Server.app/Contents/ServerRoot/private/etc/pf.anchors/400.AdaptiveFirewall' Scrub-anchor '300.NetworkLinkConditioner/*'Дummynet-anchor '300.NetworkLinkConditioner/*' In here, we see some rules (without comments): Basically, the anchor file being loaded is /etc/pf.anchors/com.apple. An anchor is a collection of rules and tables. Here, you can see that pf is configured with a number of anchors. Load anchor 'com.apple' from '/etc/pf.anchors/com.apple' To get started, letвЂ™s look at the /etc/pf.conf configuration file that comprises pf: There will be more on ALF coming in вЂњJulyвЂќ but in the meantime, thereвЂ™s something I hadnвЂ™t written much about in Lion and thatвЂ™s the pf implementation. IвЂ™ve done plenty of writing on the Application Layer Firewall (ALF) and the IP FireWall (IPFW) in OS X over the years.

Firewall for mac os x lion