Can someone give me a hint on how to setup a basic deny rule whenever any TCP request is sent to a specific IP address? I am using the PF packet filter. Any help?

1 Answer 1


The most basic form would look like this, in your /etc/pf.conf config:

block from any to

# which is equivalent to:
block drop from any to

By default this block action will drop packets silently on all interfaces, from any source IP, in both directions. Because a client is unaware it is being blocked it will timeout and likely try again, and again...

block return is the 'friendly neighbor' way to let the client know the address is unreachable by responding in a protocol specific way, with a TCP RST (reset) or ICMP UNREACHABLE packet. A client can use this information to give up, or try again in a sane way.

block return from any to

The default block behavior can be changed using the set block-policy option.

A more involved example - but easier to manage and read when your rule set starts to grow:

mybadhosts = "{, }"
ext_if = "em0"

block return on $ext_if from any to $mybadhosts                 # example #1
block return on em0 from any to {, }   # ^expanded form

block drop out on egress from any to $mybadhosts                # example #2

example #1 Shows simple use of variables, a list {}, a netmask /24, and specifies an interface em0. (Note variables are defined without a $ sign, and quotes are removed, when rules are expanded at runtime)

example #2 Drops out outbound packets, on the egress interface group (see ifconfig(8))

See Also:

  • @techraf I updated the answer to try and better clarify return behavior vs drop. thoughts?
    – pete
    Mar 20, 2016 at 3:33
  • I was trying to understand, now it's clear. Thanks.
    – techraf
    Mar 20, 2016 at 3:34
  • block command line not found on OS X ???? Sep 19, 2016 at 15:42
  • 1
    @AbdennourTOUMI the block command is not for your shell, if that is what you are trying. The syntax needs to be used in your /etc/pf.conf
    – pete
    Sep 21, 2016 at 1:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .