Can someone give me a hint on how to setup a basic deny rule whenever any TCP request is sent to a specific IP address? I am using the PF packet filter. Any help?
1 Answer
The most basic form would look like this, in your /etc/pf.conf config:
block from any to 192.0.2.2
# which is equivalent to:
block drop from any to 192.0.2.2
By default this block action will drop packets silently on all interfaces, from any source IP, in both directions. Because a client is unaware it is being blocked it will timeout and likely try again, and again...
block return is the 'friendly neighbor' way to let the client know the address is unreachable by responding in a protocol specific way, with a TCP RST (reset) or ICMP UNREACHABLE packet. A client can use this information to give up, or try again in a sane way.
block return from any to 192.0.2.2
The default block behavior can be changed using the set block-policy option.
A more involved example - but easier to manage and read when your rule set starts to grow:
mybadhosts = "{ 192.0.2.2, 203.0.113.0/24 }"
ext_if = "em0"
block return on $ext_if from any to $mybadhosts # example #1
block return on em0 from any to { 192.0.2.2, 203.0.113.0/24 } # ^expanded form
block drop out on egress from any to $mybadhosts # example #2
example #1 Shows simple use of variables, a list {}, a netmask /24, and specifies an interface em0. (Note variables are defined without a $ sign, and quotes are removed, when rules are expanded at runtime)
example #2 Drops out outbound packets, on the egress interface group (see ifconfig(8))
See Also:
