MacOS – OS X: How to lock down these frivolous protocols!

You can do this using the builtin ipfw firewall (it is not the default firewall in Snow Leopard, but it is still included). You can configure from the command line, the exact rule set you need depends on your other requirements, but the specific rule in question would be something like:

# allow AFP (port 548) traffic from 10net
/sbin/ipfw add allow tcp from 10.0.0/24 to any 548

# deny all other AFP traffic 
ipfw add deny tcp from any to any 548

Obviously you will need to adjust that for your specific network. Also, these rules are not persistent, which means you will need to add a script to run them commands every reboot. On the other hand, that means that if you wedge your networking while trying to come up with appropriate rules you can always just reboot to reset the stack. There are plenty of ipfw tutorials on the web (most of them are aimed at FreeBSD users, but it is the same interface).

You should:

1. understand pf basics - here is many guides on the Internet, you can safely read any Open/Free BSD guide. You must understand a few basic things:

   • with PF, last rule wins (opposite of IPFW's "first rule wins")
   • logging is in the pflog device if the 'tcpdump' format
   • check the pfctl command using man pfctl
   • also check man pf.conf
   • you can create many simple text files that contains IP addresses (called tables) and using them in the filtering rules - see the example below.

2. AFTER this you can use two GUI frontends

   • IceFloor (instead of the WaterRoof)
   • Firewall builder (cross platform)

PF is not too hard if you have some knowledge about how firewalling works in general.

Fragment of pf.conf for table based filtering:

interface = "en0"
allowed_ports = "{ 80, 443 }"
table <badips> persist
table <noroute> const { 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8 }
block in on $interface from { <noroute>, <badips> } to any
pass in on $interface inet proto tcp from <badips> to $interface port $allowed_ports

The above example contains:

• some basic definitions, like your interface name and some ports
• definition for two tables, noroute for nonroutable addresses (RFC 1918) and the second badips that can contain your Geo IP based IP addresses
• filtering rule - blocking anything from these tables
• allowing ports 80 and 443 from badips (last rule wins)