0

How to write a PF firewall rule that filters communications between processes on the same host?

From reading the man pages, I understand that packets must physically traverse the given interface for the rule to take effect - and that packets sent from a local interface to another local interface, will be handled by the host's TCP/IP stack without being subject to filtering.

But how can I then write a PF firewall rule filtering all traffic from a local interface to another local interface, e.g:

DROP <local-src-ip>:<local-src-port> -> <local-target-ip>:<local-target-port>

Improve this question
3
  • Do you mean 'inter process communication'?
    – Panki
    Commented Aug 19, 2019 at 6:27
  • No, I mean communication sent between processes on the same host, not necessarily from-to the same process.
    – Shuzheng
    Commented Aug 19, 2019 at 6:53
  • Not sure if help you but iptables have that functionality with the parameters (--uid-owner userid, --pid-owner processid and --cmd-owner name)
    – camp0
    Commented Aug 19, 2019 at 7:32

1 Answer 1

Reset to default
0

How to write a PF firewall rule […]

Are you asking about methodology or giving you an example of such a rule? Either way, I'd say it shouldn't be hard to accomplish that task on your own:

Since Pf has notion of such filtering criteria as user (and group) you should be able to enforce needed policy.

man pf.conf: "…

user user — This rule only applies to packets of sockets owned by the specified user. For outgoing connections initiated from the firewall, this is the user that opened the connection. For incoming connections to the firewall itself, this is the user that listens on the destination port.

…"

Start with logging all traffic on loopback interface — since loopback would be used for such kind of communications. Some tutorials has set skip on lo0 rule there for granted, but obviously you'd need the opposite, throw this one out. You might make use of (self) keyword as well — to restrict ruleset to addresses belonging to the host for sure, but this might not be strictly needed OTOH.

Keep in mind that Pf can differ significantly between its various ports-n-versions. For e. g., the one that is shipped with MacOS is vastly outdated and some features won't work contrary to what the man page says.

Improve this answer
5
  • poige - thanks for your answer. I can now create firewall rules that target inter-localhost traffic. What made me confused was the rdr section of the pf man page said something like "only traffic that physically traverses the given interface is subject to the rdr rule", making me think that this statement applies to ALL traffic/ANY rule, which is not true (localhost traffic doesn't traverse ANY interface, it's handled locally, right?). Do you have a good resource that describes WHEN pf rules apply? :)
    – Shuzheng
    Commented Sep 3, 2019 at 7:39
  • Well, rdr is a part of NAT infrastructure which isn't about access control but "adjusting" the traffic if needed. As to the good resource — I've seen some books around, but they weren't free so being proficient with Pf I'm not sure if I should buy one. ;-)
    – poige
    Commented Sep 3, 2019 at 7:47
  • Nevertheless, rdr works on lo0 as well. :)
    – poige
    Commented Sep 3, 2019 at 7:48
  • How can rdr work on lo0? Is it because that ALL traffic will always traverse a source interface? I.e. inter-localhost traffic will have lo0 as its source interface, and thus rules targeting traffic entering on lo0 will be in effect? However, will traffic delivered to another local process also be subject to rules targetting traffic leaving on lo0?
    – Shuzheng
    Commented Sep 3, 2019 at 7:58
  • Check it out en.wikipedia.org/wiki/Loopback#Virtual_loopback_interface Loopback is pretty essential device for most (all?) of TCP/IP stacks implementation.
    – poige
    Commented Sep 3, 2019 at 8:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .