where to put pfctl rules to make them persistent

Question

ok i found out how to use pfctl on OS X Mavericks/Server 3i have some set of rules and they work if i type two commands:pfctl -e # to enable packet filterpfctl -f myrulesbut where should i put all this to be persistent (across reboots and OS upgrades)What i a recommended place?

MrHoffman · Answer

Lingon is a GUI that allows access to the launchd data; there&#x27;s an older free version of the app around, and there&#x27;s a version of Lingon in the App Store.  There are launchd examples around the &#x27;net, as well.  For finding your way &#x27;round the Unix layers of the file system and related, see the File System Programming Guide (PDF) (HTML); that has an intro to the Mac app directories, to sandboxing on OS X, and to the Unix directories.

Akorzh · Answer

yeah thanks i also guessed to add -e string myself.but the rules do not load at boot:what i have is right permissions/owner:bash-3.2# ls -l com.apple.pf*-rw-r--r--  1 root  wheel  647 29 окт 13:23 com.apple.pfctl.plist-rw-r--r--  1 root  wheel  138 24 окт 19:11 com.apple.pfd.plistand following contents:bash-3.2# cat com.apple.pfctl.plist&lt;?xml version&#x3D;"1.0" encoding&#x3D;"UTF-8"?&gt;&lt;!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"&gt;&lt;plist version&#x3D;"1.0"&gt;&lt;dict&gt;          &lt;key&gt;Disabled&lt;/key&gt;          &lt;false/&gt;          &lt;key&gt;Label&lt;/key&gt;          &lt;string&gt;com.apple.pfctl&lt;/string&gt;          &lt;key&gt;WorkingDirectory&lt;/key&gt;          &lt;string&gt;/var/run&lt;/string&gt;          &lt;key&gt;UserName&lt;/key&gt;          &lt;string&gt;root&lt;/string&gt;          &lt;key&gt;GroupName&lt;/key&gt;          &lt;string&gt;wheel&lt;/string&gt;          &lt;key&gt;Program&lt;/key&gt;          &lt;string&gt;/sbin/pfctl&lt;/string&gt;          &lt;key&gt;ProgramArguments&lt;/key&gt;          &lt;array&gt;                    &lt;string&gt;pfctl&lt;/string&gt;                    &lt;string&gt;-e&lt;/string&gt;                    &lt;string&gt;-f&lt;/string&gt;                    &lt;string&gt;/etc/pf.conf&lt;/string&gt;          &lt;/array&gt;          &lt;key&gt;RunAtLoad&lt;/key&gt;          &lt;true/&gt;&lt;/dict&gt;&lt;/plist&gt;but rules are not loaded at boot so i have to run sudo pfctl -e -f /etc/pf.confso anyone can suggest what is wrong in my setup?

Marco V · Answer

I had the same problem.It turned out that the ProgramArguments are not correct in the original plist file.Changing &lt;string&gt;pfctl&lt;/string&gt;into&lt;string&gt;/sbin/pfctl&lt;/string&gt;and adding &lt;string&gt;-e&lt;/string&gt;solved my issue.My complete plist file is:&lt;?xml version&#x3D;"1.0" encoding&#x3D;"UTF-8"?&gt;&lt;!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"&gt;&lt;plist version&#x3D;"1.0"&gt;&lt;dict&gt;          &lt;key&gt;Disabled&lt;/key&gt;          &lt;false/&gt;          &lt;key&gt;GroupName&lt;/key&gt;          &lt;string&gt;wheel&lt;/string&gt;          &lt;key&gt;Label&lt;/key&gt;          &lt;string&gt;com.apple.pfctl&lt;/string&gt;          &lt;key&gt;Program&lt;/key&gt;          &lt;string&gt;/sbin/pfctl&lt;/string&gt;          &lt;key&gt;ProgramArguments&lt;/key&gt;          &lt;array&gt;                    &lt;string&gt;/sbin/pfctl&lt;/string&gt;                    &lt;string&gt;-e&lt;/string&gt;                    &lt;string&gt;-f&lt;/string&gt;                    &lt;string&gt;/etc/pf.conf&lt;/string&gt;          &lt;/array&gt;          &lt;key&gt;RunAtLoad&lt;/key&gt;          &lt;true/&gt;          &lt;key&gt;UserName&lt;/key&gt;          &lt;string&gt;root&lt;/string&gt;          &lt;key&gt;WorkingDirectory&lt;/key&gt;          &lt;string&gt;/var/run&lt;/string&gt;&lt;/dict&gt;&lt;/plist&gt;

Leland Wallace · Answer

To minimise the disruption to the system (there are several services that muck with pf)add your rules in an anchor file (in a file under /usr/local) and add the anchor to thesystem anchors file in:/etc/pf.anchors/com.applepf can be set to start at boot via launchdsudo launchctl load -w /System/Library/LaunchDaemons/com.apple.pfctl.plistlaunchd is the Mac OS X "replacement" for init &amp; init scripts.HTH- Leland

Leland Wallace · Answer

no that will just make sure the rules are loaded correctly.you can edit the plist file to add a -e to the pfctl command though.        &lt;key&gt;ProgramArguments&lt;/key&gt;        &lt;array&gt;                &lt;string&gt;pfctl&lt;/string&gt;                &lt;string&gt;-e&lt;/string&gt;          &lt;&lt;&lt;&lt;&lt; add this line                &lt;string&gt;-f&lt;/string&gt;                &lt;string&gt;/etc/pf.conf&lt;/string&gt;        &lt;/array&gt;And it will start pf at boot, though not as early in the boot process as one would hope.HTH- Leland

Akorzh · Answer

so it looks weird: just after boot:We see that initially pfctl is not loaded, but the lauchctl has it already loaded.after unload and load it works...So any ideas?bash-3.2# pfctl -srNo ALTQ support in kernelALTQ related functions disabledbash-3.2# launchctl load -w /System/Library/LaunchDaemons/com.apple.pfctl.plistcom.apple.pfctl: Already loadedbash-3.2# launchctl unload /System/Library/LaunchDaemons/com.apple.pfctl.plistbash-3.2# launchctl load -w /System/Library/LaunchDaemons/com.apple.pfctl.plistbash-3.2# pfctl -srNo ALTQ support in kernelALTQ related functions disabledscrub-anchor "com.apple/*" all fragment reassembleanchor "com.apple/*" all

Macjournals · Answer

Credit where it&#x27;s due: Keith Stattenfeld confirmed my hunch independently, and Scott Lowe actually had the problem solved, though I didn&#x27;t realize it until later.When you use pfctl with the -f flag, you get an output message warning that using -f with a filename other than /etc/pf.conf can result in rules and anchors and such getting overwritten (because you&#x27;re starting it with a file other than the default file).  This isn&#x27;t a problem when using -f /etc/pf.conf, but pfctl doesn&#x27;t know that, so it tries to print this "helpful" message before exiting normally with status 0.This all works fine when you&#x27;re doing it from the command line.  But when you ask launchd to do it for you, there is no output set up for stdout or stderr, and this causes pfctl to exit abnormally with status 1, not starting the packet filter.  launchd unhelpfully reports only that it exited with status 1 and didn&#x27;t start, and you&#x27;re left to puzzle out why.You could probably add a "quiet" flag to pfctl to suppress this, but having less information is what got us into this mess in the first place.  As noted at the top, Scott Lowe figured this out for Mountain Lion and it still works.    The link goes to a launchd item you can add to do the trick.  Notice how it sets up standard out and standard error with log files, so when there are errors, they actually get written somewhere you can read! His login item does not set the working directory to /var/run, but you can add that. You can just drop this in a new launchd plist, and leave the system one as it is.  The system one exits because it can&#x27;t write the message it wants to write, and then your new launchd item will try again and get it right.  Alternatively, if Apple fixes the pfctl item for launchd, it will start correctly and then yours will exit (with proper logging!) because the packet filter is already running.  Either way, the answer is "pfctl wants to write text, so set up standard output and error channels so it can write text."

John Lockwood · Answer

The way we are handling pftcl is a bit of cheat, i.e. the best way 🙂We have used IceFloor to edit the rules. See http://www.hanynet.com/icefloor/IceFloor installs its own launchdaemon and a shell script and creates its own pf config files. (So that it does not get upset with any Apple changes to the standard pf files.)Rather than installing IceFloor on every Mac we have copied the launchdaemon, shellscript and config files to every client Mac and when they are rebooted the launchdaemon runs the shell script which starts pf with the config files we built with IceFloor. I have even written an installer package using Apple&#x27;s PackageMaker to copy all the files in to the right places which gets installed by DeployStudio during imaging.

MrHoffman · Answer

In a directory under /usr/local would be one spot.  That&#x27;s the local area of the Unix layer.

Akorzh · Answer

thanks for the locationbut where should i put a script for startup?kind of /etc/rc.local or init scripts or something like this ( i came from Linux world)

Akorzh · Answer

sudo launchctl load -w /System/Library/LaunchDaemons/com.apple.pfctl.plistbut will this command also enable pfctl? As it is disabled by default and i have to run "pfctl -e" to enable it

Akorzh · Answer

doesnt helps me. so pfctl is not enabled at load