Can I create a pf rule involving MAC address instead of IP?

Solution 1:

If i remember well, you can't. You can only filter mac address when you do it on a bridge if

Solution 2:

As mandrake pointed out you can't filter by MAC address directly in PF (it's an IP packet filter, it knows not of this "ethernet" thing).

What you CAN do, if your system is acting as a bridge, is tag packets based on MAC address, and then filter based on the tag.

From the pf FAQ:

Tagging Ethernet Frames

Tagging can be performed at the Ethernet level if the machine doing the tagging/filtering is also acting as a bridge(4). By creating bridge(4) filter rules that use the tag keyword, PF can be made to filter based on the source or destination MAC address. Bridge(4) rules are created using the ifconfig(8) command.
Example:

# ifconfig bridge0 rule pass in on fxp0 src 0:de:ad:be:ef:0 tag USER1

And then in pf.conf:

pass in on fxp0 tagged USER1