Firewall and Blocking [More] Traffic

Question

I have a MacBook Pro with the firewall on. I'm trying to run a Wireshark trace and the noise bleeding through Apple's firewall is very distracting. According to the image below, most of this noise is supposed to be blocked.

In practice, I'm finding a lot of Bonjour/mDNS/uPNP traffic getting through. I'd like to shut it down too.

Apple's docs don't really list anything useful for controlling the firewall. For example, there is no firewall(8) and ipfirewall(4) is a programming interface:

$ man -k firewall
ip6fw(8)                 - controlling utility for IPv6 firewall (DEPRECATED)
ipfirewall(4)            - IP packet filter and traffic accounting
ipfw(8)                  - IP firewall and traffic shaper control program (DEPRECATED)

How does one block all uninitiated inbound traffic, including promiscuous protocols like Bonjour? (I probably need to block outbound traffic too, but I can probably figure it out once I learn how to work with the firewall).

Answer 1

As of 10.7, Apple have switched to the OpenBSD project's Packet Filter (PF).

Packet filtering with PF is documented by the OpenBSD project.

PF's ability to keep state is intended to do precisely what you want: allow traffic initiated by the host to pass, while blocking the rest. "By storing information about each connection in a state table, PF is able to quickly determine if a packet passing through the firewall belongs to an already established connection. If it does, it is passed through the firewall without going through ruleset evaluation."

So you can likely start with a ruleset like

block all
pass out from any to any

so that everything but outbound traffic is banned. State entries get created for outbound traffic, which allows return traffic along that connection in, since it gets to skip the ruleset entirely.