pf.conf

#
# Default PF configuration file.
#
# This file contains the main ruleset, which gets automatically loaded
# at startup.  PF will not be automatically enabled, however.  Instead,
# each component which utilizes PF is responsible for enabling and disabling
# PF via -E and -X as documented in pfctl(8).  That will ensure that PF
# is disabled only when the last enable reference is released.
#
# Care must be taken to ensure that the main ruleset does not get flushed,
# as the nested anchors rely on the anchor point defined here. In addition,
# to the anchors loaded by this file, some system services would dynamically 
# insert anchors into the main ruleset. These anchors will be added only when
# the system service is used and would removed on termination of the service.
#
# See pf.conf(5) for syntax.
#

#
# com.apple anchor point
#
#scrub-anchor "com.apple/*"
#nat-anchor "com.apple/*"
#rdr-anchor "com.apple/*"
#dummynet-anchor "com.apple/*"
#anchor "com.apple/*"
#load anchor "com.apple" from "/etc/pf.anchors/com.apple"

# redirect hardcoded ip addresses to 127.0.0.1
table <hardcoded> file "/etc/pf.hardcoded"
nat to <hardcoded> -> 127.0.0.1
# only allow outbound connections
block in log on ! lo0
pass out on ! lo0 proto icmp
pass out on ! lo0 proto udp all
pass out on ! lo0 proto tcp all keep state
# allow mDNS + IPv6 only on en0 and lo0
block out proto udp from any to any port 5353
block inet6
pass on { en0 lo0 } proto udp from any to any port 5353
pass on { en0 lo0 } inet6
# allow only specific ICMPv6 messages, cf. icmp6(4) and
# http://www.iana.org/assignments/icmpv6-parameters/icmpv6-parameters.xhtml
block in on { en0 lo0 } inet6 proto ipv6-icmp
pass  in on { en0 lo0 } inet6 proto ipv6-icmp icmp6-type { \
    toobig timex paramprob \
    echoreq echorep nirep mtraceresp \
    groupqry grouprep groupterm 143 151 152 153 \
    neighbrsol neighbradv 148 149 }
# allow DHCP OFFER + ACK on en0
pass in on en0 proto udp from any port 67 to any port 68
pass out on ! lo0 route-to 127.0.0.1 from self to <hardcoded>