Protect NFS port mount

#1) backup the /etc/pf.conf file
$ cp /etc/pf.conf /etc/pf.conf.DATE
#2) add the following custom rules to the /etc/pf.conf file.
#firewall rules to secure rpcbind and keep it local to the host
block return in proto tcp from any to any port 111
block return in proto udp from any to any port 111
pass in inet proto tcp from 192.168.64.0/24 to any port 111 no state
pass in inet proto tcp from 127.0.0.1 to any port 111 no state
pass in inet proto udp from 192.168.64.0/24 to any port 111 no state
pass in inet proto udp from 127.0.0.1 to any port 111 no state
#3) Load the custom rules. The pf.conf is loaded automatically on a reboot.
$ sudo pfctl -f /etc/pf.conf
#4) Enable the packet filter firewall. After every reboot, this packet filter firewall needs to be re-enabled by running the following command.
$ sudo pfctl -E
#Now port 111 should no longer available to the network but should be available to localhost and 192.168.64.0/24 internal network.