I got it running with some simple modifications (and I turned it into a network logger instead of blocking some connections). It might serve as a starting point for a richer firewall capability.
(1) In the project's "Info" tab, I changed the macOS Deployment Target to 11.0 (because of something I wanted in os_log())
(2) For both targets, in "Signing & Capabilities" tabs, I changed the Team to my organization.
(3) At some point Xcode gives a lot of warnings about changes that should be made to bring it up to date with latest Swift, I let it do that.
(4) I simplified FilterDataProvider.swift to make it a simple logger (it doesn't actually block any connections)
override func startFilter(completionHandler: @escaping (Error?) -> Void) {
completionHandler(nil)
}
and
override func handleNewFlow(_ flow: NEFilterFlow) -> NEFilterNewFlowVerdict {
var localName: String = ""
var remoteName: String = ""
var remotePort: String = ""
guard let socketFlow = flow as? NEFilterSocketFlow
else {
return .allow()
}
if let remoteEndpoint = socketFlow.remoteEndpoint,
let localEndpoint = socketFlow.localEndpoint {
if let hostEndpoint = localEndpoint as? NWHostEndpoint {
localName = hostEndpoint.hostname
}
if let hostEndpoint = remoteEndpoint as? NWHostEndpoint {
remoteName = hostEndpoint.hostname
remotePort = hostEndpoint.port
}
}
os_log("firewall log \(localName, privacy: .public) -> \(remoteName, privacy: .public) : \(remotePort, privacy: .public)")
return .allow()
}
(5) I built it and then dragged the application into the Applications folder and ran it from there.
(6) Then I used the Console app to look for the connection logs. I did this by setting a filter to "firewall" (1), then set the filter type to "process" (2), hit the play button (3), and then looked for the log statements (4).
