summaryrefslogtreecommitdiff
path: root/src/leap/bitmask/vpn/fw/osx/bitmask.pf.conf
diff options
context:
space:
mode:
authorKali Kaneko (leap communications) <kali@leap.se>2017-02-22 01:42:50 +0100
committerKali Kaneko (leap communications) <kali@leap.se>2017-02-23 00:42:22 +0100
commita053c81939792582636a131c7640cf954b7638fd (patch)
tree11ab7c4a37e4b8a2f9af04520fdd73c146663fca /src/leap/bitmask/vpn/fw/osx/bitmask.pf.conf
parentf0a40443e1f2466db00f4a32273afa28e54d9dbb (diff)
[pkg] add osx helpers
Diffstat (limited to 'src/leap/bitmask/vpn/fw/osx/bitmask.pf.conf')
-rw-r--r--src/leap/bitmask/vpn/fw/osx/bitmask.pf.conf17
1 files changed, 17 insertions, 0 deletions
diff --git a/src/leap/bitmask/vpn/fw/osx/bitmask.pf.conf b/src/leap/bitmask/vpn/fw/osx/bitmask.pf.conf
new file mode 100644
index 00000000..eb0e858f
--- /dev/null
+++ b/src/leap/bitmask/vpn/fw/osx/bitmask.pf.conf
@@ -0,0 +1,17 @@
+default_device = "en99"
+
+set block-policy drop
+set skip on lo0
+
+# block all traffic on default device
+block out on $default_device all
+
+# allow traffic to gateways
+pass out on $default_device to <bitmask_gateways>
+
+# allow traffic to local networks over the default device
+pass out on $default_device to $default_device:network
+
+# block all DNS, except to the gateways
+block out proto udp to any port 53
+pass out proto udp to <bitmask_gateways> port 53