launchctl load -w /Library/LaunchDaemons/local.pfctl.plist
macOS 10.11 introduced System Integrity Protection, which makes /System (and consequently /System/Library/LaunchDaemons/com.apple.pfctl.plist) immutable, even to root. This means the plist can't be modified to enable packet filter (by adding the -E
switch to pfctl). The solution is to create a custom launchd daemon, which only calls pfctl -E
(calling pfctl -E -f /etc/pf.conf
conflicts with com.apple.pfctl.plist, which may cause failure and pf not being enabled).