is anybody here familiar with the use of PF under OSX? I'm using PF in order to force all the traffic on my MacBook going thru a VPN. In order to do so, I'm using the following pf.conf:
wifi=en0
wifi2=en1
lan1=en2
lan2=en3
lan3=en4
lan4=en5
lan5=en6
#vpn=tun0
vpn=utun0
#vpn2=tap0
set block-policy return
set skip on {lo0,$vpn}
# Scrub all incoming packets.
scrub in all
block in all
block out all
# Don't allow IPv6 at all. This is sad, but IPredator doesn't support it.
block quick inet6
# Allow DHCP.
# I could probably be more specific than "from any", but didn't find a way to
# specify the link's local network universally. "from $wifi:network" works, but
# "from $ether:network" for example doesn't as long as $ether does not exist.
pass quick on { $wifi $wifi2 $lan1 $lan2 $lan3 $lan4 $lan5 } proto udp from any port 67:68
# Allow DNS
pass out quick proto udp to any port 53
# Allow iPredator VPN.
# The destination address specification is a bit loose, but I couldn't get a
# complete list of hosts. Only allowing UDP 1194 should be enough to keep
# possible risks to a minimum.
pass quick proto udp to 46.246.32.0/19 port 1194
#Alllo all incoming and outgoind local traffic
pass in on { $wifi $wifi2 $lan1 $lan2 $lan3 $lan4 $lan5 } proto { tcp, udp, icmp } from 192.168.1.0/24 to 192.168.1.0/24
pass out on { $wifi $wifi2 $lan1 $lan2 $lan3 $lan4 $lan5 } proto { tcp, udp, icmp } from 192.168.1.0/24 to 192.168.1.0/24
Basically, the firewall works as it should. However, when I put my MacBook to sleep and open it again, the whole firewall hangs. No connections are allowed then even though the VPN connection is still active. In these cases I need to start the firewall again (pfctl -e) and then it works again. It also often happens that the VPN connection gets lost, the firewall blocks all traffic (which is correct), the VPN gets reconnected automatically but the firewall does not realize this until I restart this.
Did anybody here experience such a behavior? Is there any trick around it? thanks Norbert
