unable to block port with pfctl

Question

Level 1

0 points

unable to block port with pfctl

am trying to block the process that is listening upon the port 9110 on my MacBook Pro in order to simulate network interruption.

If I have the following rule:

-------------------------------------------------------------------

block drop quick on ALL proto tcp from any to any port = 9110

--------------------------------------------------------------------

my second process has successfully communicated with the blocked port, and the client has successfully sent requests to the blocked process. The best I could achieve is blocking all process communications with these list of rules:

---------------------

block drop in all

block drop out all

---------------------

However, it is not exactly what I need. Am I missing anything? Any commnets/suggestion will be appreciated. Here is my lsof command output:

>> lsof -i | grep 9110

java 41243 yfe 132u IPv6 0x1e7d5327e0e36555 0t0 TCP 192.168.1.68:58772->192.168.1.68:9110 (ESTABLISHED)

java 41243 yfe 145u IPv6 0x1e7d5327e0f43035 0t0 TCP 192.168.1.68:58777->192.168.1.68:9110 (ESTABLISHED)

java 41244 yfe 133u IPv6 0x1e7d5327e116eab5 0t0 TCP 192.168.1.68:58747->192.168.1.68:9110 (ESTABLISHED)

java 41244 yfe 147u IPv6 0x1e7d5327e0e3a075 0t0 TCP 192.168.1.68:58756->192.168.1.68:9110 (ESTABLISHED)

java 41253 yfe 201u IPv6 0x1e7d5327e0e38595 0t0 TCP *:9110 (LISTEN)

java 41253 yfe 278u IPv6 0x1e7d5327e0e39055 0t0 TCP 192.168.1.68:9110->192.168.1.68:58747 (ESTABLISHED)

java 41253 yfe 279u IPv6 0x1e7d5327e4a195b5 0t0 TCP 192.168.1.68:9110->192.168.1.68:58756 (ESTABLISHED)

java 41253 yfe 280u IPv6 0x1e7d5327e5560035 0t0 TCP 192.168.1.68:9110->192.168.1.68:58772 (ESTABLISHED)

MacBook Pro (13-inch Mid 2012), OS X El Capitan (10.11.3)

Posted on Mar 12, 2016 7:25 PM

Reply

Answer 1

yafeldman Author

Level 1

0 points

Mar 13, 2016 1:40 PM in response to Doug Niven1

>> sudo pfctl -v -n -f /etc/pf.conf

Password:

pfctl: Use of -f option, could result in flushing of rules

present in the main ruleset added by the system at startup.

See /etc/pf.conf for further details.

block drop quick on ALL proto tcp from any to any port = 12020

block drop quick on ALL proto tcp from any to any port = 9110

block drop quick on ALL proto tcp from any to any port = 9120

block drop quick on ALL proto tcp from any to any port = 9130

block drop quick on ALL proto tcp from any to any port = 9115

block drop quick on ALL proto tcp from any to any port = 9125

block drop quick on ALL proto tcp from any to any port = 9135

block drop quick on ALL proto udp from any to any port = 12020

block drop quick on ALL proto udp from any to any port = 9110

block drop quick on ALL proto udp from any to any port = 9120

block drop quick on ALL proto udp from any to any port = 9130

block drop quick on ALL proto udp from any to any port = 9115

block drop quick on ALL proto udp from any to any port = 9125

block drop quick on ALL proto udp from any to any port = 9135

Reply

Answer 2

Jan 19, 2017 5:52 PM in response to yafeldman

Hello yafeldman:

block drop quick on ALL proto tcp from any to any port = 9110

------------------------------------------------------------------------

The rule you create it's seem like should work but here maybe is the problem

block drop quick on ALL proto tcp from any to any port = 9110

The "ALL" you should declare begin of the document

Example : ALL = { en0 en1 en2 en3 en4 }

And your code should change to

-------------------------------------------------------------------------

block drop quick on $ALL proto tcp from any to any port = 9110

-------------------------------------------------------------------------

After declare you should always add dollar sign before variable's name when you write the rule

Example :

Untrust = { en0 en2 en3 ppp0 }

Trust = "nat0"

block log on $Untrust proto tcp from any to any port = 22

pass on $Trust proto tcp from any to any port { 80 443 }

"ALL" or "all" can not use on describe interface

Final step just refresh rule by enter commnad line pfctl -f /etc/pf.conf

Reply

Answer 3

Mar 13, 2016 9:49 AM in response to yafeldman

Post the results of the following PF sanity check:

% sudo pfctl -v -n -f /etc/pf.conf

Reply

Answer 4

yafeldman Author

Level 1

0 points

Mar 13, 2016 2:19 PM in response to yafeldman

Just wanted to let you know this issue is not resolved. I clicked mistakenly on 'Correct Answer' button in my email. Please update this thread as not solved yet.

Reply