6

Can someone give me a hint on how to setup a basic deny rule whenever any TCP request is sent to a specific IP address? I am using the PF packet filter. Any help?

6

The most basic form would look like this, in your /etc/pf.conf config:

block from any to 192.0.2.2

# which is equivalent to:
block drop from any to 192.0.2.2

By default this block action will drop packets silently on all interfaces, from any source IP, in both directions. Because a client is unaware it is being blocked it will timeout and likely try again, and again...

block return is the 'friendly neighbor' way to let the client know the address is unreachable by responding in a protocol specific way, with a TCP RST (reset) or ICMP UNREACHABLE packet. A client can use this information to give up, or try again in a sane way.

block return from any to 192.0.2.2


The default block behavior can be changed using the set block-policy option.


A more involved example - but easier to manage and read when your rule set starts to grow:

mybadhosts = "{ 192.0.2.2, 203.0.113.0/24 }"
ext_if = "em0"

block return on $ext_if from any to $mybadhosts                 # example #1
block return on em0 from any to { 192.0.2.2, 203.0.113.0/24 }   # ^expanded form

block drop out on egress from any to $mybadhosts                # example #2

example #1 Shows simple use of variables, a list {}, a netmask /24, and specifies an interface em0. (Note variables are defined without a $ sign, and quotes are removed, when rules are expanded at runtime)

example #2 Drops out outbound packets, on the egress interface group (see ifconfig(8))


See Also:

  • @techraf I updated the answer to try and better clarify return behavior vs drop. thoughts? – pete Mar 20 '16 at 3:33
  • I was trying to understand, now it's clear. Thanks. – techraf Mar 20 '16 at 3:34
  • block command line not found on OS X ???? – Abdennour TOUMI Sep 19 '16 at 15:42
  • 1
    @AbdennourTOUMI the block command is not for your shell, if that is what you are trying. The syntax needs to be used in your /etc/pf.conf – pete Sep 21 '16 at 1:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.