pf logging

Question

From Leopard days I used ipfw to fine-tune my firewall needs, but I see in Lion its use is deprecated (ref its manpage).  It seems pf is the preferred option (apart from the Application firewall, of course). Great, and I have it working, I think, though wanted to log some rules to check - and found I can&#x27;t. There is no pflogd, which seems to be the standard means of producing pf logs in the BSD world.   Does anyone know how to get logs from pf in Lion?   The pflog manpage gives how to use tcpdump, and I suppose this output could be sent to a file, but that doesn&#x27;t seem very robust, even if set as a startup item (which is deprecated, I gather, in favour of launchd).

mb99 · Answer

Found a way. Seems to work, though probably not optimal. Used bits out of &#x27;The book of PF, 2nd edition, HANSTEEN)&#x27;If anyone can see improvements, I&#x27;d be interested.Added new launch daemon/Library/LaunchDaemons/pflog.plist &lt;?xml version&#x3D;"1.0" encoding&#x3D;"UTF-8"?&gt;&lt;!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"&gt;&lt;plist version&#x3D;"1.0"&gt;&lt;dict&gt;        &lt;key&gt;Label&lt;/key&gt;                &lt;string&gt;pflog&lt;/string&gt;        &lt;key&gt;ProgramArguments&lt;/key&gt;                &lt;array&gt;                        &lt;string&gt;/usr/local/bin/pflog.sh&lt;/string&gt;                &lt;/array&gt;        &lt;key&gt;Disabled&lt;/key&gt;             &lt;false/&gt;        &lt;key&gt;RunAtLoad&lt;/key&gt;            &lt;true/&gt;        &lt;key&gt;KeepAlive&lt;/key&gt;            &lt;true/&gt;&lt;/dict&gt;&lt;/plist&gt;...which runs the following new script:/usr/local/bin/pflog.sh#! /bin/sh# bodged solution to absence of pflogd, ref &#x27;Book of PF&#x27; p136ifconfig pflog0 create/usr/sbin/tcpdump -lnettti pflog0 | /usr/bin/logger -t pf -p local2.info...which uses logger, the interface to syslogd, needing an update to its config file, ie adding a line to /etc/syslog.conflocal2.*            /var/log/pf.logAnd finally, switched the pfctl lauch daemon to start fully enabled (rather than enable on demand, as it&#x27;s set)ie added the &#x27;e&#x27; (enable) option to/System/Library/LaunchDaemons/com.apple.pfctl.plist&lt;&lt;&lt; snip        &lt;key&gt;ProgramArguments&lt;/key&gt;        &lt;array&gt;                &lt;string&gt;pfctl&lt;/string&gt;                &lt;string&gt;-ef&lt;/string&gt;                &lt;string&gt;/etc/pf.conf&lt;/string&gt;&gt;&gt;&gt; snipI should add that for the time being I&#x27;ve commented out Apple&#x27;s default anchor rules in /etc/pf.conf (which will break AirDrop, possibly other stuff too) and am using my own rules. If I could see what rules would be used by Airdrop, I might leave them in. I guess I&#x27;ll look into it if I need to.