Dumb question about pf

Question

Created Sep ’23

Replies 4

Boosts 0

Participants 2

Is it actually usable as a fireawall in macOS? I tried (as an example) adding a rule to block port 80, and it did not seem to work. But, that's all I tried -- just added a line to /etc/pf.conf

Answered by DTS Engineer in 766519022

Folks do base products on pf but my experience is that it ends badly. The issue is that there’s no documented way to arbitrate the pf rule set between system functionality and third-party products, so changes in the system can and do break these products regularly.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Boost

Answer 1

DTS Engineer OP

Apple

Sep ’23

pf is not considered a developer API on macOS, so DTS doesn’t maintain expertise in it. Someone else might chime in here, but if you not then I recommend you ask over in Apple Support Communities, run by Apple Support.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0

Answer 2

kithrup OP

Sep ’23

I asked here because we want to block a single udp port while our app is running, which means making a packet filter extension seems overkill. But I'm thinking that we may not have a lot of choice.

0

Answer 3

DTS Engineer OP

Apple

Sep ’23

Accepted Answer

Folks do base products on pf but my experience is that it ends badly. The issue is that there’s no documented way to arbitrate the pf rule set between system functionality and third-party products, so changes in the system can and do break these products regularly.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0

Answer 4

kithrup OP

Sep ’23

Ok, back to adding a second network extension I guess. (First one being a Transparent Proxy Provider, as oft mentioned. I know I can in fact put a packet filter into the same executable [although I have no idea if that's supported], but the management got annoyingly complicated.)

0