Firewall Rules - Blocking QUIC

[vaughnhart]

Hi,

I was wondering if this would be a good idea:

#block QUIC protocol
block log quick proto 253 from any to any

IF this works. it might align with the rules to block quick from the MDM side as well.

I recently pcap'ed QUIC traffic on my machine that wasn't going to Apple servers. It made me look into blocking the QUIC at the protocol level - hoping it would block quic for all applications/uses.

I

[vaughnhart]

it looks like the rule works... since all quic connections cannot complete the handshake. @

[vaughnhart]

I stand corrected... those packets shouldn't have been there and today I am seeing QUIC reroute and make the connection to Akamai directly.

[vaughnhart]

had to write a rule blocking outbound udp on port 443.

[vaughnhart]

maybe?

block out log quick from any to {mask-api.icloud.com, mask.icloud.com, mask-h2.icloud.com, mask.apple-dns.net}

this is the 2nd time the above rule doesn't work... on reboot if no DNS resolution can be made to these addresses pf won't load your ruleset., even if these addresses are in a table.

[vaughnhart]

I also found the rule: antispoof log for self - really useful. it covers all adapters but requires that pass in from 127.0.0.0 explicitly which you already do.