Firewall transparente usando macOS pf

Estoy intentando configurar un firewall transparente con una Mac mini que ejecuta macOS Sierra. Básicamente estoy tratando de hacer esto (solo con macOS): Un cortafuegos transparente utilizando OpenBSD

Esta es mi configuración de red:

Internet <-ethernet-> Router <-ethernet->en0 Mac mini en4<-ethernet-> AppleTV

El enrutador también se conecta a varios otros dispositivos a través de Wifi.

Esto es lo que hice en el Mac mini para convertirlo en un firewall transparente:

1. Configuré el puente a través de estos comandos:

   sudo ifconfig bridge1 create
   sudo ifconfig bridge1 addm en0 addm en4
   sudo ifconfig bridge1 up
   

Desde la perspectiva de AppleTV, ahora parece que Mac mini no existe.

2. Configuré pf agregando esto a /etc/pf.conf :

   anchor "org.user"
   load anchor "org.user" from "/etc/pf.anchors/org.user"
   

   y creó /etc/pf.anchors/org.user con este contenido:

   # skip lo0
   set skip on lo0
   
   # options
   set block-policy drop
   
   # rules
   block on en4 all
   

   Luego "reinicié" pf con las nuevas reglas:

   sudo pfctl -f /etc/pf.conf
   sudo pfctl -e
   

Ahora esperaría que no haya tráfico de AppleTV en la red. Pero AppleTV todavía funciona como si nunca hubiera configurado esas reglas pf.

¿Qué me estoy perdiendo?

PS: Aquí está la salida de ifconfig:

MacMini:~ Daniel$ ifconfig
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
    options=1203<RXCSUM,TXCSUM,TXSTATUS,SW_TIMESTAMP>
    inet 127.0.0.1 netmask 0xff000000 
    inet6 ::1 prefixlen 128 
    inet6 fe80::1%lo0 prefixlen 64 scopeid 0x1 
    nd6 options=201<PERFORMNUD,DAD>
gif0: flags=8010<POINTOPOINT,MULTICAST> mtu 1280
stf0: flags=0<> mtu 1280
en0: flags=8963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
    options=10b<RXCSUM,TXCSUM,VLAN_HWTAGGING,AV>
    ether a8:20:66:1e:9a:62 
    inet6 fe80::1cca:5c4b:64a7:7350%en0 prefixlen 64 secured scopeid 0x4 
    inet6 2a02:8070:a89:8f00:181c:12bc:a98c:7229 prefixlen 64 autoconf secured 
    inet6 2a02:8070:a89:8f00:d489:89da:9083:17d8 prefixlen 64 autoconf temporary 
    inet6 2a02:8070:a89:8f00::9 prefixlen 64 dynamic 
    inet 192.168.0.137 netmask 0xffffff00 broadcast 192.168.0.255
    nd6 options=201<PERFORMNUD,DAD>
    media: autoselect (1000baseT <full-duplex,flow-control,energy-efficient-ethernet>)
    status: active
en4: flags=8963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
    options=b<RXCSUM,TXCSUM,VLAN_HWTAGGING>
    ether 00:23:56:1c:82:26 
    inet6 fe80::223:56ff:fe1c:8226%en4 prefixlen 64 scopeid 0x5 
    nd6 options=201<PERFORMNUD,DAD>
    media: autoselect (100baseTX <full-duplex>)
    status: active
en1: flags=8823<UP,BROADCAST,SMART,SIMPLEX,MULTICAST> mtu 1500
    ether 20:c9:d0:93:5e:f1 
    nd6 options=201<PERFORMNUD,DAD>
    media: autoselect (<unknown type>)
    status: inactive
fw0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 4078
    lladdr 00:3e:e1:ff:fe:b3:04:08 
    nd6 options=201<PERFORMNUD,DAD>
    media: autoselect <full-duplex>
    status: inactive
en3: flags=963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX> mtu 1500
    options=60<TSO4,TSO6>
    ether 32:00:1b:30:40:80 
    media: autoselect <full-duplex>
    status: inactive
bridge0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
    options=63<RXCSUM,TXCSUM,TSO4,TSO6>
    ether 32:00:1b:30:40:80 
    Configuration:
        id 0:0:0:0:0:0 priority 0 hellotime 0 fwddelay 0
        maxage 0 holdcnt 0 proto stp maxaddr 100 timeout 1200
        root id 0:0:0:0:0:0 priority 0 ifcost 0 port 0
        ipfilter disabled flags 0x2
    member: en3 flags=3<LEARNING,DISCOVER>
            ifmaxaddr 0 port 8 priority 0 path cost 0
    nd6 options=201<PERFORMNUD,DAD>
    media: <unknown type>
    status: inactive
p2p0: flags=8802<BROADCAST,SIMPLEX,MULTICAST> mtu 2304
    ether 02:c9:d0:93:5e:f1 
    media: autoselect
    status: inactive
awdl0: flags=8902<BROADCAST,PROMISC,SIMPLEX,MULTICAST> mtu 1484
    ether 8e:36:65:e0:9a:1e 
    nd6 options=201<PERFORMNUD,DAD>
    media: autoselect
    status: inactive
utun0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 2000
    inet6 fe80::9a58:4bd5:9f77:f77a%utun0 prefixlen 64 scopeid 0xc 
    nd6 options=201<PERFORMNUD,DAD>
utun1: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1380
    inet6 fe80::1e34:cc36:613b:1ee6%utun1 prefixlen 64 scopeid 0xf 
    nd6 options=201<PERFORMNUD,DAD>
ppp0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1280
    inet 10.0.1.16 --> 1.0.0.1 netmask 0xffffff00 
bridge1: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
    options=3<RXCSUM,TXCSUM>
    ether aa:20:66:e1:cb:01 
    Configuration:
        id 0:0:0:0:0:0 priority 0 hellotime 0 fwddelay 0
        maxage 0 holdcnt 0 proto stp maxaddr 100 timeout 1200
        root id 0:0:0:0:0:0 priority 0 ifcost 0 port 0
        ipfilter disabled flags 0x2
    member: en0 flags=3<LEARNING,DISCOVER>
            ifmaxaddr 0 port 4 priority 0 path cost 0
    member: en4 flags=3<LEARNING,DISCOVER>
            ifmaxaddr 0 port 5 priority 0 path cost 0
    media: autoselect
    status: active
MacMini:~ Daniel$