MacOS – Configure ipfw to filter by ip range

You should:

1. understand pf basics - here is many guides on the Internet, you can safely read any Open/Free BSD guide. You must understand a few basic things:

   • with PF, last rule wins (opposite of IPFW's "first rule wins")
   • logging is in the pflog device if the 'tcpdump' format
   • check the pfctl command using man pfctl
   • also check man pf.conf
   • you can create many simple text files that contains IP addresses (called tables) and using them in the filtering rules - see the example below.

2. AFTER this you can use two GUI frontends

   • IceFloor (instead of the WaterRoof)
   • Firewall builder (cross platform)

PF is not too hard if you have some knowledge about how firewalling works in general.

Fragment of pf.conf for table based filtering:

interface = "en0"
allowed_ports = "{ 80, 443 }"
table <badips> persist
table <noroute> const { 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8 }
block in on $interface from { <noroute>, <badips> } to any
pass in on $interface inet proto tcp from <badips> to $interface port $allowed_ports

The above example contains:

• some basic definitions, like your interface name and some ports
• definition for two tables, noroute for nonroutable addresses (RFC 1918) and the second badips that can contain your Geo IP based IP addresses
• filtering rule - blocking anything from these tables
• allowing ports 80 and 443 from badips (last rule wins)

The dialog is not coming from ipfw but from socketfilterfw, the OS X Application based firewall. That one is not port based, like ipfw but based on processes. If an application/script wants to bind a port the application firewall checks it's ruleset and subsequently asks the user if that should be allowed which is what you already see. If you allow this, the binary in question gets signed and is allowed access in the future without user interaction. If the binary changes, you get asked again.

The only way to prevent getting asked is to turn off the app firewall which I do not recommend. Alternatively you could start signing each change of your python files which is likely to become annoying.

Sidenote: If you need a port based firewall as well you should be using pf (pf.conf(5), pfctl(8)) on Mountain-Lion as ipfw is deprecated.