0

I am an OSX user, and I want to ban some hostnames, with which some local applications may do nasty things.

pfctl is the default firewall on OSX 10.11 El captain. So, how to block the specific hostnames with pfctl?

I know that modifying hosts file can block specific hostname via resolving it to an unknown IP. However, under my circumstance, hosts method doesn't work. So, I want to use pfctl instead.

0

You can, but you do not need to ban host names with pfctl.

You can do it using /etc/hosts. In fact, that is the way I have been doing it for years. It is lighter on resources than pfctl, since you do not need to solve the names, nor inspect traffic. It has also the advantage of blocking all instances of a known name, since site names can resolve to several IP addresses nowadays.

$ dig A  cnn.com
; <<>> DiG 9.8.3-P1 <<>> A cnn.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 22656
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 4, ADDITIONAL: 2

;; QUESTION SECTION:
;cnn.com.           IN  A

;; ANSWER SECTION:
cnn.com.        242 IN  A   157.166.226.26
cnn.com.        242 IN  A   157.166.226.25

;; AUTHORITY SECTION:
cnn.com.        172707  IN  NS  ns3.timewarner.net.
cnn.com.        172707  IN  NS  ns2.p42.dynect.net.
cnn.com.        172707  IN  NS  ns1.timewarner.net.
cnn.com.        172707  IN  NS  ns1.p42.dynect.net.

;; ADDITIONAL SECTION:
ns1.timewarner.net. 172707  IN  A   204.74.108.238
ns3.timewarner.net. 172707  IN  A   199.7.68.238

;; Query time: 5 msec
;; SERVER: 192.168.201.1#53(192.168.201.1)
;; WHEN: Sun Nov 22 07:35:00 2015
;; MSG SIZE  rcvd: 186

The way to do it is editing hosts

sudo /etc/hosts

and populating it with the address 0.0.0.0 followed with the name of the site you want to block. People used to used 127.0.0.1 instead, however due to Windows compatibility problems, and due to 0.0.0.0 signalling you do not have even to try to open the connection, 0.0.0.0 is used nowadays.

If your concerns are malware, besides adding your own, you can use this list as a starting point, which is one of the better known.

"Blocking Unwanted Connections with a Hosts File"

http://winhelp2002.mvps.org/hosts.htm

Here is an example of some of my entries in /etc/hosts

0.0.0.0 youtu.be
0.0.0.0 allsrtfree.com
0.0.0.0 serve.adplxmd.com
0.0.0.0 www.subtitlseex.xyz
0.0.0.0 fukizi.com
0.0.0.0 www.themoviesarea.com
0.0.0.0 www.dream-marriage.com
0.0.0.0 system-protection.6offers.com
0.0.0.0 adstrx.com
0.0.0.0 mackeeperapp3.mackeeper.com
0.0.0.0 www.download-genius.com
0.0.0.0 cdn.myfreesoftwarehub.com
0.0.0.0 cdn.freefairs.com
0.0.0.0 piratetorrents.net

If you still want to use pf, it seems you have to use it together with relayd, for it not to block IP addresses, but to block sites.

I have found a slide talking about it:

http://quigon.bsws.de/papers/2013/vbsdcon/mgp00043.html

As a footnote, if you want a good graphical firewall in OS/X, Little Snitch is excellent, and also blocks at application level.

https://www.obdev.at/products/littlesnitch/index.html

  • 1
    Sorry, I knew the method of modifying hosts file. It doesn't work under my circumstance due to that shadowsocks can bypass local hosts file(I don't know why). That is why I want to ban a specific hostname via pfctl... – user3824053 Nov 22 '15 at 12:18
  • Have a look at the paragraph before the last... "If you still..." You can also use a local DNS server, or RPZ in BIND. Why are you people using SOCKS in this day and age, when we have IPsec? Easier to setup? I have a Mac too, and doing VPN to a pfSense at work an a Linux Debian ARM at home, all configured to be done using the native Cisco IPsec client that you can configure in an Iphone or OS/X using System Preferences – Rui F Ribeiro Nov 22 '15 at 12:28
  • Socks can bypass hosts file because you can configure firefox either to resolve DNS names locally or remotely. – Rui F Ribeiro Nov 22 '15 at 12:35
  • You know, Chinese Internet is slightly different. I use shadowsocks as a system proxy. but it seems also forward dns queries which makes local hosts file invalid. I don't know how to avoid bypass local hosts. – user3824053 Nov 22 '15 at 13:30
  • interesting, it seems that thing about DNS is done in purpose for the DNS replies not to be corrupted/poisoned locally – Rui F Ribeiro Nov 22 '15 at 13:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.