Sto provando a configurare un firewall trasparente con un Mac mini con macOS Sierra. Fondamentalmente sto provando a farlo (solo con macOS): Un firewall trasparente che usa OpenBSD
Questa è la mia configurazione di rete:
Internet <-ethernet-> Router <-ethernet->en0 Mac mini en4<-ethernet-> AppleTV
Il router si collega anche a molti altri dispositivi tramite Wifi.
Ora ecco cosa ho fatto su Mac mini per renderlo un firewall trasparente:
-
Ho configurato il bridge tramite questi comandi:
sudo ifconfig bridge1 create sudo ifconfig bridge1 addm en0 addm en4 sudo ifconfig bridge1 up
Dal punto di vista di AppleTV ora è come se il Mac mini non esistesse.
-
Ho configurato pf aggiungendo questo a
/etc/pf.conf
:anchor "org.user" load anchor "org.user" from "/etc/pf.anchors/org.user"
e creato
/etc/pf.anchors/org.user
con questo contenuto:# skip lo0 set skip on lo0 # options set block-policy drop # rules block on en4 all
Poi ho "riavviato" pf con le nuove regole:
sudo pfctl -f /etc/pf.conf sudo pfctl -e
Ora non mi aspetto alcun traffico da AppleTV per entrare nella rete. Ma AppleTV funziona ancora come se non avessi mai impostato le regole del pf.
Cosa mi manca?
PS: ecco l'output di ifconfig:
MacMini:~ Daniel$ ifconfig
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
options=1203<RXCSUM,TXCSUM,TXSTATUS,SW_TIMESTAMP>
inet 127.0.0.1 netmask 0xff000000
inet6 ::1 prefixlen 128
inet6 fe80::1%lo0 prefixlen 64 scopeid 0x1
nd6 options=201<PERFORMNUD,DAD>
gif0: flags=8010<POINTOPOINT,MULTICAST> mtu 1280
stf0: flags=0<> mtu 1280
en0: flags=8963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
options=10b<RXCSUM,TXCSUM,VLAN_HWTAGGING,AV>
ether a8:20:66:1e:9a:62
inet6 fe80::1cca:5c4b:64a7:7350%en0 prefixlen 64 secured scopeid 0x4
inet6 2a02:8070:a89:8f00:181c:12bc:a98c:7229 prefixlen 64 autoconf secured
inet6 2a02:8070:a89:8f00:d489:89da:9083:17d8 prefixlen 64 autoconf temporary
inet6 2a02:8070:a89:8f00::9 prefixlen 64 dynamic
inet 192.168.0.137 netmask 0xffffff00 broadcast 192.168.0.255
nd6 options=201<PERFORMNUD,DAD>
media: autoselect (1000baseT <full-duplex,flow-control,energy-efficient-ethernet>)
status: active
en4: flags=8963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
options=b<RXCSUM,TXCSUM,VLAN_HWTAGGING>
ether 00:23:56:1c:82:26
inet6 fe80::223:56ff:fe1c:8226%en4 prefixlen 64 scopeid 0x5
nd6 options=201<PERFORMNUD,DAD>
media: autoselect (100baseTX <full-duplex>)
status: active
en1: flags=8823<UP,BROADCAST,SMART,SIMPLEX,MULTICAST> mtu 1500
ether 20:c9:d0:93:5e:f1
nd6 options=201<PERFORMNUD,DAD>
media: autoselect (<unknown type>)
status: inactive
fw0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 4078
lladdr 00:3e:e1:ff:fe:b3:04:08
nd6 options=201<PERFORMNUD,DAD>
media: autoselect <full-duplex>
status: inactive
en3: flags=963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX> mtu 1500
options=60<TSO4,TSO6>
ether 32:00:1b:30:40:80
media: autoselect <full-duplex>
status: inactive
bridge0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
options=63<RXCSUM,TXCSUM,TSO4,TSO6>
ether 32:00:1b:30:40:80
Configuration:
id 0:0:0:0:0:0 priority 0 hellotime 0 fwddelay 0
maxage 0 holdcnt 0 proto stp maxaddr 100 timeout 1200
root id 0:0:0:0:0:0 priority 0 ifcost 0 port 0
ipfilter disabled flags 0x2
member: en3 flags=3<LEARNING,DISCOVER>
ifmaxaddr 0 port 8 priority 0 path cost 0
nd6 options=201<PERFORMNUD,DAD>
media: <unknown type>
status: inactive
p2p0: flags=8802<BROADCAST,SIMPLEX,MULTICAST> mtu 2304
ether 02:c9:d0:93:5e:f1
media: autoselect
status: inactive
awdl0: flags=8902<BROADCAST,PROMISC,SIMPLEX,MULTICAST> mtu 1484
ether 8e:36:65:e0:9a:1e
nd6 options=201<PERFORMNUD,DAD>
media: autoselect
status: inactive
utun0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 2000
inet6 fe80::9a58:4bd5:9f77:f77a%utun0 prefixlen 64 scopeid 0xc
nd6 options=201<PERFORMNUD,DAD>
utun1: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1380
inet6 fe80::1e34:cc36:613b:1ee6%utun1 prefixlen 64 scopeid 0xf
nd6 options=201<PERFORMNUD,DAD>
ppp0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1280
inet 10.0.1.16 --> 1.0.0.1 netmask 0xffffff00
bridge1: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
options=3<RXCSUM,TXCSUM>
ether aa:20:66:e1:cb:01
Configuration:
id 0:0:0:0:0:0 priority 0 hellotime 0 fwddelay 0
maxage 0 holdcnt 0 proto stp maxaddr 100 timeout 1200
root id 0:0:0:0:0:0 priority 0 ifcost 0 port 0
ipfilter disabled flags 0x2
member: en0 flags=3<LEARNING,DISCOVER>
ifmaxaddr 0 port 4 priority 0 path cost 0
member: en4 flags=3<LEARNING,DISCOVER>
ifmaxaddr 0 port 5 priority 0 path cost 0
media: autoselect
status: active
MacMini:~ Daniel$