I think it is called firewall. I am basically trying to set up something that tells the Mac to not connect to internet without active VPN on. So all internet has to connect via VPN. How do I do this?

I want to know it especially for the Mac, but if you know about it for ios, too, it would be helpful, too, so either one, thanks.


Mac OS X comes with two firewalls installed by default. One visible is System Preferences is the application firewall and won't be of any help in this case.

The other is a packet filtering firewall called pf, however it does not offer a GUI.

Basically you need to block all outgoing connections on your regular network interface except the one to the VPN server and pass all traffic on the VPN interface.

The configuration of the firewall is in the /etc/pf.conf file. You need to add at least the following rules (the following assumes your regular interface is en0 and VPN's tun0).

block out on en0 from any to any
pass out on en0 from any to <vpn_server_IP>
pass out on tun0 from any to any

Remember that the last rule "wins".

After modifying the contain file run to load the rules:

pfctl -e
pfctl -f /etc/pf.conf

To disable the firewall run:

pfctl -d

The rules above are minimal ones for the purpose you specified, you might also need to add a rule to access your local network through the regular interface. Also they block DNS, so you'd need to specify the IP of the VPN server not its DNS name when connecting.

  • Thanks. Where do I find the /etc/pf.conf file? I could not find it in Terminal or Finder. – user119330 Aug 3 '16 at 10:25
  • You need to use Terminal. To edit it you need to open it in an editor, for example: sudo nano /etc/pf.conf – techraf Aug 3 '16 at 10:52

pf rulesets can be made fairly simply using fwbuilder, but the syntax varies. you are better off running firewalling on a pfsense box, and since it's pretty lightweight run the vpn service there as well (transparently for all your lan clients).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.