Using PF under OSX but skipping local interface

Question

I'm using PF under OSX to force the OS the make all external connections via a VPN to Ipredator. However, as soon as I start PF all local connections are blocked even though I thought I told PF to skip that interface. Is anybody here familiar with the use of PF under OSX and can give me a hint? Here is my pf.conf:

#
# com.apple anchor point
#
#scrub-anchor "com.apple/*"
#nat-anchor "com.apple/*"
#rdr-anchor "com.apple/*"
#dummynet-anchor "com.apple/*"
#anchor "com.apple/*"
#load anchor "com.apple" from "/etc/pf.anchors/com.apple"


    wifi=en0
    wifi2=en1
    lan1=en2
    lan2=en3
    lan3=en4
    lan4=en5
    lan5=en6
    vpn=tun0
    vpn2=tap0

    # Default block policy is sending a RST. This allows applications to quickly
    # notice that they are not allowed to connect.
    set block-policy return
    set skip on lo0
    set skip on $vpn
    # Don't filter on local loopback or the VPN interface.
    #set skip on { lo0 $vpn } 

    # Scrub all incoming packets.
    scrub in all

    # Don't allow IPv6 at all. This is sad, but IPredator doesn't support it.
    block quick inet6

    # By default, don't allow anything on the actual physical links.
    block on { $wifi $wifi2 $lan1 $lan2 $lan3 $lan4 $lan5}


    # Allow DHCP.
    # I could probably be more specific than "from any", but didn't find a way to
    # specify the link's local network universally. "from $wifi:network" works, but
    # "from $ether:network" for example doesn't as long as $ether does not exist.
    pass quick on { $wifi $wifi2 $lan1 $lan2 $lan3 $lan4 $lan5 } proto udp from any port 67:68

    # Allow DNS 
    pass out quick proto udp to any port 53

    # Allow iPredator VPN.
    # The destination address specification is a bit loose, but I couldn't get a
    # complete list of hosts. Only allowing UDP 1194 should be enough to keep
    # possible risks to a minimum.
    pass quick proto udp to 46.246.32.0/19 port 1194

    # vim: ft=pf

Thanks in advance!

Norbert

In the meantime I did some more debugging. One issue that I seem to have are the lines:

set skip on lo0
set skip on $vpn

Seems that I needed to combine them to

set skip on { lo0, $vpn }

However, the effect is still the same. Local connections are still blocked. And When I list the ruleset, it seems that the skip commands did not end in the ruleset:

sudo pfctl -sr                                                     [15:45:33]
No ALTQ support in kernel
ALTQ related functions disabled
scrub in all fragment reassemble
block drop quick inet6 all
block drop on en0 all
block drop on en1 all
block drop on en2 all
block drop on en3 all
block drop on en4 all
block drop on en5 all
block drop on en6 all
pass quick on en0 proto udp from any port 67:68 to any keep state
pass quick on en1 proto udp from any port 67:68 to any keep state
pass quick on en2 proto udp from any port 67:68 to any keep state
pass quick on en3 proto udp from any port 67:68 to any keep state
pass quick on en4 proto udp from any port 67:68 to any keep state
pass quick on en5 proto udp from any port 67:68 to any keep state
pass quick on en6 proto udp from any port 67:68 to any keep state
pass out quick proto udp from any to any port = 53 keep state
pass quick inet proto udp from any to 46.246.32.0/19 port = 1194 keep state

Very strange....

One way to help troubleshoot this is to add logging to your ruleset, then capture on the `pflog` interface; Wireshark can show the blocked packet, the reason, and the rule number that caused it. (I can't recall atm how to see the blocking rule number in the term) — pete, Feb 01 '16 at 13:10
also, the `set skip` won't show up in the ruleset because its not an actual rule, so you are ok in that regard. What is returned if you run `pfctl -vs Interfaces`? Is `lo0` marked as skip? — pete, Feb 02 '16 at 01:25

Using PF under OSX but skipping local interface

0 Answers0