Usando o PF no OSX, mas ignorando a interface local

Question

Estou usando o PF no OSX para forçar o sistema operacional a fazer todas as conexões externas através de uma VPN ao Ipredator. No entanto, assim que inicio o PF, todas as conexões locais são bloqueadas, embora eu ache que eu disse ao PF para pular essa interface. Alguém aqui está familiarizado com o uso de PF sob OSX e pode me dar uma dica? Aqui está o meu pf.conf:

#
# com.apple anchor point
#
#scrub-anchor "com.apple/*"
#nat-anchor "com.apple/*"
#rdr-anchor "com.apple/*"
#dummynet-anchor "com.apple/*"
#anchor "com.apple/*"
#load anchor "com.apple" from "/etc/pf.anchors/com.apple"


    wifi=en0
    wifi2=en1
    lan1=en2
    lan2=en3
    lan3=en4
    lan4=en5
    lan5=en6
    vpn=tun0
    vpn2=tap0

    # Default block policy is sending a RST. This allows applications to quickly
    # notice that they are not allowed to connect.
    set block-policy return
    set skip on lo0
    set skip on $vpn
    # Don't filter on local loopback or the VPN interface.
    #set skip on { lo0 $vpn } 

    # Scrub all incoming packets.
    scrub in all

    # Don't allow IPv6 at all. This is sad, but IPredator doesn't support it.
    block quick inet6

    # By default, don't allow anything on the actual physical links.
    block on { $wifi $wifi2 $lan1 $lan2 $lan3 $lan4 $lan5}


    # Allow DHCP.
    # I could probably be more specific than "from any", but didn't find a way to
    # specify the link's local network universally. "from $wifi:network" works, but
    # "from $ether:network" for example doesn't as long as $ether does not exist.
    pass quick on { $wifi $wifi2 $lan1 $lan2 $lan3 $lan4 $lan5 } proto udp from any port 67:68

    # Allow DNS 
    pass out quick proto udp to any port 53

    # Allow iPredator VPN.
    # The destination address specification is a bit loose, but I couldn't get a
    # complete list of hosts. Only allowing UDP 1194 should be enough to keep
    # possible risks to a minimum.
    pass quick proto udp to 46.246.32.0/19 port 1194

    # vim: ft=pf

Obrigado antecipadamente!

Norbert

Nesse meio tempo, fiz mais algumas depurações. Uma questão que pareço ter são as linhas:

set skip on lo0
set skip on $vpn

Parece que eu precisava combiná-los para

set skip on { lo0, $vpn } 

No entanto, o efeito ainda é o mesmo. Conexões locais ainda estão bloqueadas. E quando eu listo o conjunto de regras, parece que os comandos de pulo não terminaram no conjunto de regras:

sudo pfctl -sr                                                     [15:45:33]
No ALTQ support in kernel
ALTQ related functions disabled
scrub in all fragment reassemble
block drop quick inet6 all
block drop on en0 all
block drop on en1 all
block drop on en2 all
block drop on en3 all
block drop on en4 all
block drop on en5 all
block drop on en6 all
pass quick on en0 proto udp from any port 67:68 to any keep state
pass quick on en1 proto udp from any port 67:68 to any keep state
pass quick on en2 proto udp from any port 67:68 to any keep state
pass quick on en3 proto udp from any port 67:68 to any keep state
pass quick on en4 proto udp from any port 67:68 to any keep state
pass quick on en5 proto udp from any port 67:68 to any keep state
pass quick on en6 proto udp from any port 67:68 to any keep state
pass out quick proto udp from any to any port = 53 keep state
pass quick inet proto udp from any to 46.246.32.0/19 port = 1194 keep state

Muito estranho ...