How to launch pf at startup? I am looking for a pretty elegant way to launch the pf - a.k.a. Packet Filtering - process at startup. Using the launchctl or the pfctl commands, root privileges are required and so it is useless to add them into .bash_profile. Are there alternative solutions to this issue?
By default pf is silenced at startup, a launch daemon com.apple.pfctl.plist exists though in /System/Library/LaunchDaemons/. To enable pf while booting you would have to add an -e switch in the plist.

Since all files in /System/Library/LaunchDaemons/ are protected by SIP in macOS 10.11 and later you have to disable it first.

Then, after booting to the main system, edit the launch daemon plist:

sudo nano /System/Library/LaunchDaemons/com.apple.pfctl.plist


and replace

  ...
  &lt;key&gt;ProgramArguments&lt;/key&gt;
  &lt;array&gt;
    &lt;string&gt;/sbin/pfctl&lt;/string&gt;
    &lt;string&gt;-f&lt;/string&gt;
    &lt;string&gt;/etc/pf.conf&lt;/string&gt;
  &lt;/array&gt;
  ...


with

  ...
  &lt;key&gt;ProgramArguments&lt;/key&gt;
  &lt;array&gt;
    &lt;string&gt;/sbin/pfctl&lt;/string&gt;
    &lt;string&gt;-e&lt;/string&gt;
    &lt;string&gt;-f&lt;/string&gt;
    &lt;string&gt;/etc/pf.conf&lt;/string&gt;
  &lt;/array&gt;
  ...


Reboot to Recovery Mode and enable SIP again.