MacOS – Black hole all IP addresses except for 192.168.1.1

macos

I have a machine. I want to configure it so that it can only talk to 192.168.1.1 (gitserver) and 127.0.0.1 (localhost).

This machine is meant to be pure work, no distractions.

I'm on OS X Lion.

I'm familiar with iptables on Linux, but not sure how to configure this (or if it's even possible).

What do I need to read up to make this work?

PS: configuring the router is not an option; it's some simple $30 router.

Best Answer

Mac OS X like other BSD systems uses ipfw instead of iptables. Read the man page for full reference.

One way to would be to deny all TCP "establish connection" packets except those directed to gitserver, leaving all other traffic untouched:

ipfw add allow tcp from me to gitserver setup
ipfw add allow tcp from me to me setup # may not be needed
ipfw add deny tcp from any to any setup

The rules will be lost on reboot, so they must be set on every boot (e.g. from /etc/rc.common or crontab's @reboot).

If that seems too complicated, get a third party firewall. Little Snitch is a good one, but it costs another $30 :)