The same PF bug is breaking one of OrbStack's networking features. I found it hard to believe when I narrowed it down to this, but I guess I'm not alone. Really hoping this is fixed before the stable release.
I didn't get a chance to report this to Apple until yesterday, but I think it's a fairly recent regression, probably from around beta 6.
PF is supposed to be a last-match firewall but it's almost like macOS is doing first-match now: an earlier "block" rule (without "quick") is overriding "pass" rules in a different anchor, which obviously breaks things.
I didn't get a chance to report this to Apple until yesterday, but I think it's a fairly recent regression, probably from around beta 6.
PF is supposed to be a last-match firewall but it's almost like macOS is doing first-match now: an earlier "block" rule (without "quick") is overriding "pass" rules in a different anchor, which obviously breaks things.