Disable Bonjour in 10.10 without breaking DNS or WiFi

To answer my own question, here's the hackaround we've come up with so far:

Disable Bonjour

Create /private/etc/pf.conf.mdns-disable with the following contents

# /private/etc/pf.conf.mdns-disable

# block mulicast dns (bonjour/avahi/mdns)

block inet proto udp from any to any port mdns

block inet from {224.0.0.251, FF02::FB} to any

block inet from any to {224.0.0.251, FF02::FB}

2. Append the following line to the end of /private/etc/pf.conf

include "/private/etc/pf.conf.mdns-disable"

3. Restart the firewall (or reboot).

Re-enable Bonjour

1. Comment out the following line in /private/etc/pf.conf

include "/private/etc/pf.conf.mdns-disable"

to as follows

# include "/private/etc/pf.conf.mdns-disable"

2. Restart the firewall (or reboot).

Note: The assumption here is the system firewall is always enabled.

Reload firewall right now (insecure but practical):

sudo sh -c 'pfctl -df /etc/pf.conf && pfctl -ef /etc/pf.conf'

Note: Rebooting is more secure because temporarily disabling the firewall creates a small window of increased attack surface.

(The first Reply actually solved it, but there's neither Unstar nor remove "This helped me." (Really awful UX.))

-- Deleted --

**Updated** /private/etc/pf.conf.mdns-disable

# /private/etc/pf.conf.mdns-disable

# block mulicast dns (bonjour/avahi/mdns)

block inet proto {tcp,udp} from any to any port mdns

block inet6 proto {tcp,udp} from any to any port mdns

block inet from 224.0.0.251

block inet6 from FF02::FB

block inet to 224.0.0.251 # these might be redundant

block inet6 to FF02::FB #

10.10.1 does not address --no-multicast and WiFi.

Updated: Don't use any of these, it's a pain to start pfctl correctly.

Use IceFloor, it works great and it's far easier to manage.