Codescribe 289a46dc2c feat: add macOS pf DNS interception ...

Implement DNS interception on macOS using pf (packet filter):
- Anchor injection into running ruleset (not /etc/pf.conf)
- route-to lo0 + rdr rules for locally-originated DNS capture
- _ctrld group exemption so ctrld's own queries bypass interception
- Watchdog to detect and restore wiped anchor rules
- Probe-based auto-heal for Parallels VM pf corruption
- IPv6 DNS blocking and block-return for clean timeouts
- Interface-specific tunnel detection for VPN coexistence
- Port 5354 fallback in intercept mode

Includes pf technical reference docs and test scripts.

Squashed from intercept mode development on v1.0 branch (#497).

2026-03-03 14:27:43 +07:00

..

test-dns-intercept.ps1

feat: add macOS pf DNS interception

2026-03-03 14:27:43 +07:00

test-recovery-bypass.ps1

feat: add macOS pf DNS interception

2026-03-03 14:27:43 +07:00