Using Packet Filter (pf) firewall to block outgoing traffic on macOS

Recently I found out that PyCharm from JetBrains, despite being a wonderful IDE for Python, is continuously broadcasting my username to 230.230.230.230 for license check, see here for a report of the same problem for another Jetbrains’ product, which has the same underpinning IDE as PyCharm.

Naturally, I want a firewall to block the outgoing traffic to avoid leaking my private information to any network I might connect to.

The OS X application firewall (see Apple notes) can block incoming traffic on per-application basis and prevent applications from listening on network ports, but unfortunately it cannot be configured to block outgoing traffic.

The application firewall, however, is indeed implemented with Packet Filter from OpenBSD project. Remember Mac OS X is part of the BSD family? PF has been shipped with recent releases of Mac OS X since Lion, including macOS since Sierra.

There are a number of third-party applications/firewalls on the market such as murus. But they basically provide the user a GUI to configure PF on macOS - of course sometimes with other useful features as well - and they are mostly paid application (although murus does have a lite version that is free).

But if you’re comfortable with command line as I am, all GUI applications are overkill for the problem in hand. It’s possible to configure PF to block outgoing traffic in several easy step and less than a few minutes!

  1. First, create a new anchor file named /etc/pf.anchors/jetbrains with the following PF rule to block traffic on interface en0 for any traffic sent to IP multicast address 230.230.230.230:

     $ cat /etc/pf.anchors/jetbrains
     block drop log quick on en0 from any to 230.230.230.230
    

    You would need sudo privillege to create file under /etc/pf.anchors. An anchor file is used to hold a sub-ruleset, which we will attach to the main PF ruleset in the next step. quick asks PF to stop further processing should a packet matches the rule. See PF filter reference on the syntax of the rules for more details.

  2. Then add the jetbrains anchor to the default PF configuration file /etc/pf.conf. This allows the anchor and the rules to be active whenever you activate the macOS firewall without interfering with any application firewall rule you might have defined through GUI.

     $ cat /etc/pf.conf
     #
     # Default PF configuration file.
     ...
     # See pf.conf(5) for syntax.
     #
    
     #
     # com.apple anchor point
     #
     scrub-anchor "com.apple/*"
     nat-anchor "com.apple/*"
     rdr-anchor "com.apple/*"
     dummynet-anchor "com.apple/*"
     anchor "com.apple/*"
     load anchor "com.apple" from "/etc/pf.anchors/com.apple"
    
     #
     # jetbrains anchor point
     #
     anchor "jetbrains"
     load anchor "jetbrains" from "/etc/pf.anchors/jetbrains"
    
  3. Last, start the firewall from System PreferencesSecurity & PrivacyFirewall.

Tested with the following software versions:

Other useful resource for PF on macOS:


Contents on this site are licensed under a Creative Commons Attribution-ShareAlike 4.0 International License. Creative Commons License