Hi dmd,
I'm not totally sure what you mean by this:
am i correct in assuming that this will work with 10.6.8, since it uses ipfw and not pf?
These rules/script is not for pf; it won't work.
but if you want the script working on a network with 10.6.8.xxx address space, and also only connects to Castor, change this line:
sudo ipfw add 02000 allow ip from 172.17.0.0/16 to 108.59.8.147 keep-state
to:
sudo ipfw add 02000 allow ip from 10.6.8.0/24 to 95.211.169.3 keep-state
"how would i go about only using these rules for en0 "
Add "on en0" on rules 1600, 1800 and 2000 after "allow ip" like this (you could also change "ip" to tcp or udp if you only want to connect using one or the other - the script was meant to be useful in the most number of cases without protocol issues. Also I have found for the tun0 connection using ip works the best, so leave those ones as is.):
sudo ipfw add 02000 allow ip on en0 from 10.6.8.0/24 to 95.211.169.3 keep-state
you don't want to do the other rules because they're for lo ( rule 1000), and for tun0 (rules 5000 and 5200)
" my private ip space (all electronics in my network) is 10.0.0.0/16; would i even need "sudo ipfw add 02000 allow ip from <strong>172.17.0.0/16</strong> to 108.59.8.147 keep-state"?"
That is the rule that connects you to the VPN server, so yes, and modified as above to reflect using Castor instead of Sirius and your address space instead of 172.17.x.x space.
"//EDIT:
basically, i want to deny every outgoing connection that is not going through tun0 (95.211.169.3 -- castor). internal network access should be allowed though; the ip address space is 10.0.1.0-10.0.1.200."
I'm going to have to check into the subnet masking for this one, as AirVPN is also using 10.x.x.x address space. If your home network was using 172.x.x.x or 192.x.x.x, it would be easy, but you don't want your external and internal traffic interfering with each other. Otherwise, the rules as they are will tunnel everything through tun0.
You can confirm that by running the script and trying to connect with any software to anyplace on the internet when you are connected to something other than AirVPN (ie. just your router,etc) , and the Castor server. If you can get web access or email, etc, while not connected to Castor, then there is a problem. If you only get access when connected to Castor, it is working as intended.
I hope that helps, and I'll do some number crunching later with the subnets and see if I can come up with a local network rule for you.
jz