Ask Different is a question and answer site for power users of Apple hardware and software. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How can I use ipfw (or another tool, if one is available) to allow unlimited access between computers on my LAN, but not allow access to the Internet?

(The IPs on my local LAN are

share|improve this question
Turning off the internet router/modem is not an option I assume? Or just unplugging the cable between the router and your internet provider? Should the access restrictions apply to all users or only to specific ones? – patrix Dec 10 '11 at 11:55
Yes. In my specific case, I want one computer to be able to access the Internet, but not the others. – TJ Luoma Dec 14 '11 at 19:28
up vote 3 down vote accepted

Has been a while since I've used ipfw but running the following commands on all relevant computers should do the trick:

 sudo ipfw -f flush
 sudo ipfw add allow tcp from me to
 sudo ipfw add allow ip from me to
 sudo ipfw add deny tcp from me to any
 sudo ipfw add deny ip from me to any

To disable just run sudo ipfw flush again

share|improve this answer
This seemed to work perfectly. Thanks! (Adding -f before 'flush' kept it from asking for confirmation, which was what I wanted.) – TJ Luoma Dec 14 '11 at 19:34

The crudest way I can think of to do this, assuming your network is based on static IPs, is to just not populate the "Default Gateway" IP in the network configuration.

If you are on a DHCP network, you could change the DHCP server configuration, but that would break the internet access of all computers on the LAN, not just some of them.

share|improve this answer

As I was looking for an answer to this, I found another way to do it which does not use ipfw. I'll mention it here in case anyone else is looking for a similar answer later.

The other way to do this is to set the DNS servers to

This can accomplished on the command line using networksetup like this:

networksetup -setdnsservers Wi-Fi

If you have an Ethernet connection, you will want to use

networksetup -setdnsservers Ethernet

To revert this change, I was able to use 'empty' instead of ''

networksetup -setdnsservers Ethernet empty

but, depending on your network setup, you may need to specify the actual IP address of your DNS servers instead of using empty.

I still think ipfw is a better tool for the job, but I mention this just in case someone prefers it.

The reason this works for allowing access to other computers on my LAN is that I can access them using hostname.local. instead. For example, the hostname for my MacBook Air is 'air' so I can use ssh air.local. to connect to it, even without DNS servers.

share|improve this answer

you can use ipfw to block all traffic to port 80 which is http. You will need to check if you also need to block other ports e.g. 443, 110, 993 etc

From the comment below, did you want to have http access between machines on your network? If so just do above and then add the exception to allow http to machines on your ip range. e.g. /24 if thats what your network is.

share|improve this answer
-1 : Did you even read the question? – Fake Name Dec 10 '11 at 11:34
well just add an exception for them ip's on that port. updated my answer – lennard Dec 10 '11 at 11:37
Have you still not read the question? He wants everything accessible from the LAN, and nothing accessible from the WAN. Doing that on a port-by-port and ip-by-ip basis is idiotic. – Fake Name Dec 10 '11 at 11:46
he won't be typing in every ip just allow /24 for example. personally i would do this on a router so everyone in the subnet gets exactly what he's asking for but he want's to use a different tool such as ipfw – lennard Dec 10 '11 at 11:53

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.