sudo pfctl -s infoShow whether pf is enabled, with counters.
When to use it
Use pf when the app firewall isn't enough: blocking specific IP addresses or ports for all apps, limiting a service to the local network, or port redirection. Mistakes can cut your Mac off the network, so test carefully and keep a way back.
Steps
Check the status
pf is usually disabled unless something (the app firewall, Internet Sharing, a VPN) enabled it.sudo pfctl -s infoLook at Apple's configuration
The default /etc/pf.conf only loads Apple's anchors. Don't edit it; system updates may replace it.cat /etc/pf.confWrite rules in your own anchor
Create /etc/pf.anchors/blockexample with a rule, for example: block drop out quick to 203.0.113.0/24sudo nano /etc/pf.anchors/blockexampleTest and load
-n parses without loading; then load into the anchor and enable pf.sudo pfctl -n -f /etc/pf.anchors/blockexample && sudo pfctl -a blockexample -f /etc/pf.anchors/blockexample && sudo pfctl -ERemove the rules
Flush the anchor's rules to undo.sudo pfctl -a blockexample -F rules
Output explained
The default /etc/pf.conf on macOS 15 (comments removed):
scrub-anchor "com.apple/*"
nat-anchor "com.apple/*"
rdr-anchor "com.apple/*"
dummynet-anchor "com.apple/*"
anchor "com.apple/*"
load anchor "com.apple" from "/etc/pf.anchors/com.apple"
Only Apple's anchors are loaded. Your rules in a separate anchor stay independent and are easy to remove.
pfctl -E prints a Token; pf stays enabled while any token is held. pfctl -X TOKEN releases yours.
Options and variations
| Flag | Meaning | Example |
|---|---|---|
| -s info|rules|states | Show status, rules or the state table | sudo pfctl -s rules |
| -a ANCHOR | Work inside an anchor | sudo pfctl -a blockexample -s rules |
| -f FILE | Load rules from a file | sudo pfctl -a blockexample -f rules.conf |
| -n | Parse only, don't load | sudo pfctl -n -f rules.conf |
| -E / -X TOKEN | Enable pf with a reference / release it | sudo pfctl -E |
| -F rules|states|all | Flush rules or states | sudo pfctl -a blockexample -F rules |
Common errors
| Error | Cause | Fix |
|---|---|---|
| pfctl: Use of -f option, could result in flushing of rules present in the main ruleset added by the system at startup. | Loading into the main ruleset | Always load your rules into an anchor with -a. |
| Rules don't apply | pf isn't enabled | Run sudo pfctl -E. |
| Rules gone after restart | Anchors aren't loaded at boot | Add a launchd job to load them, or a load line in a custom config. |
Do it in the app
Before blocking anything, LightAtom's connections view shows which addresses your apps actually use, so you block exactly what you mean to.
Frequently asked questions
Does macOS have pf?
Yes. macOS includes the pf packet filter from OpenBSD, controlled with pfctl. The app firewall in System Settings is a separate, simpler layer.
Is pf enabled by default on Mac?
pf is usually disabled until a feature such as Internet Sharing or certain VPNs enables it. Check with sudo pfctl -s info.
How do I block an IP address on a Mac?
Put a rule like block drop out quick to 203.0.113.10 in your own anchor file, load it with sudo pfctl -a NAME -f FILE, and enable pf with sudo pfctl -E.