pfctl config to only allow OpenVPN connection

I found what appears to be a suitable guide here, but pfctl complains of a syntax error and "no IP address found for en3" which is my main interface. I have had other pf rules working successfully to forward ports, etc. but I cannot figure this out.

I am on 10.11.4 and using Tunnelblick connected to a OpenVPN server i installed myself on a VPS.

Could someone give instructions on the correct configuration for pfctl on El Capitan? I need to keep open access to private networks like 10.0.0.0 and 168.1.0.0

Thanks!

Solution 1:

The following works on Sierra.

Append the following lines to the end of /etc/pf.conf

anchor "org.vpnonly.pf"
load anchor "org.vpnonly.pf" from "/etc/pf.anchors/org.vpnonly.pf.rules"

Create this configuration file at /etc/pf.anchors/org.vpnonly.pf.rules

# Options
set block-policy drop
set fingerprints "/etc/pf.os"
set ruleset-optimization basic
set skip on lo0

# Interfaces
vpn_intf = "{ utun0 utun1 utun2 utun3 }"

# Ports
allowed_vpn_ports = "{ 1:65535 }"

# Table with allowed IPs
table <allowed_vpn_ips> persist file "/etc/pf.anchors/vpn.list" file "/etc/pf.anchors/custom.list"

# Block all outgoing packets
block out all

# Antispoof protection
#had to disable this to avoid error
#antispoof for $vpn_intf inet

# Allow outgoing packets to specified IPs only
pass out proto icmp from any to <allowed_vpn_ips>
pass out proto {tcp udp} from any to <allowed_vpn_ips> port $allowed_vpn_ports

# Allow traffic for VPN interfaces
pass out on $vpn_intf all

Create /etc/pf.anchors/vpn.list and /etc/pf.anchors/custom.list

sudo touch /etc/pf.anchors/vpn.list /etc/pf.anchors/custom.list

Add a list of allowed IP addresses (addresses of VPN servers) to /etc/pf.anchors/vpn.list

41.xxx.xxx.xxx
42.xxx.xxx.xxx

Add google DNS to custom /etc/pf.anchors/custom.list 8.8.8.8 8.8.4.4

sudo pfctl -e -f /etc/pf.conf and check for errors

To load at startup, edit to default pfctl at /System/Library/LaunchDaemons/com.apple.pfctl.plist to set <key>Disabled</key> <true/>

ensure rootless mode is disabled. (boot to recovery terminal with Command+R at the chime and run csrutil disable run these commands, then return to recovery terminal afterwards to reenable rootless with csrutil enable

Create your LaunchDaemon at /Library/LaunchDaemons/com.apple.pfctl.plist

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>com.apple.pfctl</string>
<key>ProgramArguments</key>
    <array>
        <string>pfctl</string>
        <string>-e</string>
        <string>-f</string>
        <string>/etc/pf.conf</string>
    </array>
    <key>RunAtLoad</key>
    <true/>
</dict>
</plist>

finish with sudo chmod 644 /Library/LaunchDaemons/com.apple.pfctl.plist, reboot with rootless mode enabled and you're set.

pfctl config to only allow OpenVPN connection

Solution 1:

Related

Recent Posts