pfctl config to only allow OpenVPN connection
The following works on Sierra.

Append the following lines to the end of /etc/pf.conf

anchor "org.vpnonly.pf"
load anchor "org.vpnonly.pf" from "/etc/pf.anchors/org.vpnonly.pf.rules"


Create this configuration file at /etc/pf.anchors/org.vpnonly.pf.rules

# Options
set block-policy drop
set fingerprints "/etc/pf.os"
set ruleset-optimization basic
set skip on lo0

# Interfaces
vpn_intf = "{ utun0 utun1 utun2 utun3 }"

# Ports
allowed_vpn_ports = "{ 1:65535 }"

# Table with allowed IPs
table &lt;allowed_vpn_ips&gt; persist file "/etc/pf.anchors/vpn.list" file "/etc/pf.anchors/custom.list"

# Block all outgoing packets
block out all

# Antispoof protection
#had to disable this to avoid error
#antispoof for $vpn_intf inet

# Allow outgoing packets to specified IPs only
pass out proto icmp from any to &lt;allowed_vpn_ips&gt;
pass out proto {tcp udp} from any to &lt;allowed_vpn_ips&gt; port $allowed_vpn_ports

# Allow traffic for VPN interfaces
pass out on $vpn_intf all


Create /etc/pf.anchors/vpn.list and /etc/pf.anchors/custom.list

sudo touch /etc/pf.anchors/vpn.list /etc/pf.anchors/custom.list

Add a list of allowed IP addresses (addresses of VPN servers) to /etc/pf.anchors/vpn.list

41.xxx.xxx.xxx
42.xxx.xxx.xxx


Add google DNS to custom /etc/pf.anchors/custom.list
    8.8.8.8
    8.8.4.4

sudo pfctl -e -f /etc/pf.conf and check for errors

To load at startup, edit to default pfctl at /System/Library/LaunchDaemons/com.apple.pfctl.plist to set
&lt;key&gt;Disabled&lt;/key&gt;
&lt;true/&gt;

ensure rootless mode is disabled. (boot to recovery terminal with Command+R at the chime and run csrutil disable run these commands, then return to recovery terminal afterwards to reenable rootless with csrutil enable

Create your LaunchDaemon at /Library/LaunchDaemons/com.apple.pfctl.plist

&lt;?xml version="1.0" encoding="UTF-8"?&gt;
&lt;!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"&gt;
&lt;plist version="1.0"&gt;
&lt;dict&gt;
&lt;key&gt;Label&lt;/key&gt;
&lt;string&gt;com.apple.pfctl&lt;/string&gt;
&lt;key&gt;ProgramArguments&lt;/key&gt;
    &lt;array&gt;
        &lt;string&gt;pfctl&lt;/string&gt;
        &lt;string&gt;-e&lt;/string&gt;
        &lt;string&gt;-f&lt;/string&gt;
        &lt;string&gt;/etc/pf.conf&lt;/string&gt;
    &lt;/array&gt;
    &lt;key&gt;RunAtLoad&lt;/key&gt;
    &lt;true/&gt;
&lt;/dict&gt;
&lt;/plist&gt;


finish with sudo chmod 644 /Library/LaunchDaemons/com.apple.pfctl.plist, reboot with rootless mode enabled and you're set.