mac-scripts/ARD-SSH-pf.conf at master · marckerr/mac-scripts · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
#
# Default PF configuration file.
#
# This file contains the main ruleset, which gets automatically loaded
# at startup. PF will not be automatically enabled, however. Instead,
# each component which utilizes PF is responsible for enabling and disabling
# PF via -E and -X as documented in pfctl(8). That will ensure that PF
# is disabled only when the last enable reference is released.
#
# Care must be taken to ensure that the main ruleset does not get flushed,
# as the nested anchors rely on the anchor point defined here. In addition,
# to the anchors loaded by this file, some system services would dynamically
# insert anchors into the main ruleset. These anchors will be added only when
# the system service is used and would removed on termination of the service.
#
# See pf.conf(5) for syntax.
#

#
# com.apple anchor point
#
pflog_logfile="/var/log/pflog"
scrub-anchor "com.apple/*"
nat-anchor "com.apple/*"
rdr-anchor "com.apple/*"
dummynet-anchor "com.apple/*"
anchor "com.apple/*"
load anchor "com.apple" from "/etc/pf.anchors/com.apple"


### START Custom Rules ###

ARD_tcp = "{ 88 3283 5900 5988 }"
ARD_udp = "{ 3283 }"

AllowedIn = "{ 192.168.0.0/24, 192.168.1.0/24 }"

block return in proto tcp from any to any port 22
block return in proto tcp from any to any port \$ARD_tcp

block return in proto udp from any to any port \$ARD_udp

pass in inet proto tcp from <AllowedIn> to any port 22 no state
pass in inet proto tcp from <AllowedIn> to any port \$ARD_tcp no state

pass in inet proto udp from <AllowedIn> to any port \$ARD_udp no state

### END Custom Rules ###