I have just inherited a Mac OS X server that is using pf. The problem I am trying to solve is why I can't ping OUT of the server. I can ping to the machine no worries, but just get timeouts on pinging out.


$ ping
PING ( 56 data bytes
Request timeout for icmp_seq 0
Request timeout for icmp_seq 1
Request timeout for icmp_seq 2
--- ping statistics ---
4 packets transmitted, 0 packets received, 100.0% packet loss

There is a pretty simple pf config where a set of known "good" ip addresses is setup in a table (actually, a number of tables), and they are allowed access using:

pass in from { <my-good-ips1>, <my-good-ips2>, <my-good-ips3> } to any

These are also allowed in:

pass in quick inet proto udp from any port 67 to any port 68

Everything thing else is blocked.

And (most importantly) all traffic is allowed out:

pass out proto tcp from any to any keep state
pass out proto udp from any to any keep state

Do you think I am even on the mark looking at pf. Or should I be directing my investigations down another track?

  • 2
    I would suggest opening icmp with state: pass out proto icmp from any to any keep state – gerhard d. May 19 '16 at 6:49

You're missing pass proto icmp.

It's usually a reasonable measure to have as your first pass rule:

pass quick proto icmp

Otherwise you're implicitly blocking that traffic. ICMP is its own protocol, remember, and not covered by TCP or UDP. See the OpenBSD page on PF.

  • Thanks. But to complete my picture of this situation, I am not understanding why I can ping in, just not out? To me, without the above line, it shouldn't allowed any ICMP from anywhere, in or out. Is that a fair assumption? – brizrobbo May 20 '16 at 4:34
  • @brizrobbo your initial pass in rule pass in from { <my-good-ips1>, ... } to any doesn't specify a protocol, which implies they're allowed. The rule will allow any traffic from ips in that table to reach any hosts behind the firewall. PF is stateful, which means the response echo is allowed back out. – Ryder May 20 '16 at 4:45
  • Also, just as an aside— pass in from port 67 to port 68 is a little weird. Most services don't even allow you to select an egress port, but assign one above 32768 at random (the kernel handles outgoing traffic). Do you realize you'd need to have a way of constraining what port your service is going out on to reach your MacOSX Server on port 68? – Ryder May 20 '16 at 5:00
  • Good pickup. My guess is that it is to allow for DHCP (as these are for bootps and bootpc respectively). So that the DHCP servers don't need to be in the express list of "good IPs". Although, that's a big guess. :-) – brizrobbo May 20 '16 at 5:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.