MacOS – Prevent any direct internet traffic when OpenVPN is down

Usually, Bonjour only works on the local network and only its extension Wide-Area-Bonjour works through VPNs. Did you configure your Computer to use that or did you setup your router to handle that? Also, which other resources appear for the others at work?

But anyway, you don´t have to have File Sharing "turned on" on your computer (which will then cause the broadcasting of your computer´s name over Bonjour) to access others, so just turn off the services you don´t want others to see and you should be good.

I found the answer.

I loaded my rules as part of the anchor com.apple/100.InternetSharing/natpmp which is the one used for Internet Sharing.

The file mitm.pf.conf contains the rules:

rdr on bridge0 proto tcp from any to any port 80 -> 127.0.0.1 port 8080
rdr on bridge0 proto tcp from any to any port 443 -> 127.0.0.1 port 8080`

Load it using the Internet Sharing anchor:

sudo pfctl -a com.apple/100.InternetSharing/natpmp -f mitm.pf.conf