¿Por qué no puedo crear nuevas conexiones de red después de habilitar PF con un simple conjunto de reglas personalizadas utilizando
pfctl -f?
Estoy leyendo el tutorial oficial de las FAQ para el firewall PF de OpenBSD, también utilizado en MacOS.
Tengo una sola interfaz de red en0 pero después de cargar mi conjunto de reglas personalizadas ( sudo pfctl -ef ~/pf.conf ), no puedo crear nuevas conexiones:
# block all traffic by default
block all
# allow outgoing traffic
pass out on en0 inet proto { tcp, udp } from any to any keep stateLas reglas cargadas:
$ sudo pfctl -s rules
No ALTQ support in kernel
ALTQ related functions disabled
block drop all
pass out on en0 inet proto tcp all flags S/SA keep state
pass out on en0 inet proto udp all keep stateSé que pass las reglas implican keep state para que el host de destino pueda responder y completar el handshake TCP.
¿Por qué no funciona?
Registros (como sugiere @dan):
11:38:57.252593 IP localhost.54219 > localhost.domain: 25416+ AAAA? tweak.dk. (26)
11:38:57.252653 IP localhost.64032 > localhost.domain: 49819+ A? tweak.dk. (26)
11:38:57.258578 IP localhost.57029 > localhost.domain: 60542+ AAAA? storage.tweak.dk. (34)
11:38:57.258636 IP localhost.63731 > localhost.domain: 1707+ A? storage.tweak.dk. (34)
11:38:57.378386 IP localhost.56727 > localhost.domain: 65417+ AAAA? clients1.google.com. (37)
11:38:57.378522 IP localhost.62210 > localhost.domain: 139+ A? clients1.google.com. (37)
11:38:57.443665 IP 192.168.0.2.34813 > broadcasthost.faximum: UDP, length 173
11:38:57.501016 IP localhost.62183 > localhost.domain: 11629+ AAAA? clients1.google.com. (37)
11:38:57.501147 IP localhost.53388 > localhost.domain: 42774+ A? clients1.google.com. (37)
11:38:57.511827 IP localhost.62420 > localhost.domain: 38225+ AAAA? clients1.google.com. (37)
11:38:57.511887 IP localhost.64524 > localhost.domain: 15042+ A? clients1.google.com. (37)
11:38:57.604447 IP localhost.59068 > localhost.domain: 13668+ AAAA? clients1.google.com. (37)
11:38:57.604519 IP localhost.51720 > localhost.domain: 55562+ A? clients1.google.com. (37)
11:38:57.693499 IP localhost.56993 > localhost.domain: 39058+ AAAA? init-p01st.push.apple.com. (43)
11:38:57.693545 IP localhost.57235 > localhost.domain: 27525+ A? init-p01st.push.apple.com. (43)
11:38:57.848208 IP localhost.61766 > localhost.domain: 22338+ AAAA? clients1.google.com. (37)
11:38:57.848280 IP localhost.54073 > localhost.domain: 33542+ A? clients1.google.com. (37)
11:38:58.037646 IP localhost.64422 > localhost.domain: 24380+ AAAA? clients1.google.com. (37)
11:38:58.037706 IP localhost.60153 > localhost.domain: 10848+ A? clients1.google.com. (37)
11:38:58.255389 IP localhost.54219 > localhost.domain: 25416+ AAAA? tweak.dk. (26)
11:38:58.255440 IP localhost.64032 > localhost.domain: 49819+ A? tweak.dk. (26)
11:38:58.259328 IP localhost.57029 > localhost.domain: 60542+ AAAA? storage.tweak.dk. (34)
11:38:58.259380 IP localhost.63731 > localhost.domain: 1707+ A? storage.tweak.dk. (34)
11:38:58.362581 IP localhost.63716 > localhost.domain: 6695+ AAAA? clients1.google.com. (37)
11:38:58.362662 IP localhost.57058 > localhost.domain: 1829+ A? clients1.google.com. (37)
11:38:58.457064 IP localhost.60834 > localhost.domain: 35607+ AAAA? clients1.google.com. (37)
11:38:58.457124 IP localhost.50331 > localhost.domain: 18857+ A? clients1.google.com. (37)
11:38:58.672209 IP 192.168.0.158 > 224.0.0.251: igmp v2 report 224.0.0.251
11:38:58.994741 IP localhost.57453 > localhost.domain: 12397+ AAAA? api-glb-bln.smoot.apple.com. (45)
11:38:58.994777 IP localhost.51068 > localhost.domain: 22480+ A? api-glb-bln.smoot.apple.com. (45)
11:38:59.030947 IP localhost.58518 > localhost.domain: 37923+ A? clients4.google.com. (37)
11:38:59.460793 IP localhost.60834 > localhost.domain: 35607+ AAAA? clients1.google.com. (37)
11:38:59.460846 IP localhost.50331 > localhost.domain: 18857+ A? clients1.google.com. (37)
11:39:00.258957 IP localhost.54219 > localhost.domain: 25416+ AAAA? tweak.dk. (26)
11:39:00.259010 IP localhost.64032 > localhost.domain: 49819+ A? tweak.dk. (26)
11:39:00.260138 IP localhost.57029 > localhost.domain: 60542+ AAAA? storage.tweak.dk. (34)
11:39:00.260199 IP localhost.63731 > localhost.domain: 1707+ A? storage.tweak.dk. (34)
11:39:00.413401 IP 192.168.0.2.34813 > broadcasthost.faximum: UDP, length 173
