Ask Different is a question and answer site for power users of Apple hardware and software. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've setup the profile manager and locking a laptop works great while on the same LAN as the Lion server but if I'm outside the office it will never get the remote lock request. The Lion server is behind a NAT. Do I need to forward ports to the lion server?

share|improve this question

Yes, you'll need to either forward these ports to your Lion server, or put the Lion server in your firewall's DMZ. You will also need to make sure that the DNS name of your Lion server is resolvable to devices outside of your network.

The Apple Push Notification service used by Profile Manager will tell your device "Check in with this server", but your server needs to be resolvable and accessible for your device to actually check in and get the command that you've set for it in Profile Manager. That's why the lock command is working while your laptop is on the same LAN as the server.

share|improve this answer
That's the way. – Miles Leacy Jun 12 '12 at 14:11
do you know what ports need to be opened? – Mike Jun 13 '12 at 9:29
2195, 2196 - TCP - Used by Profile Manager to send push notifications 5223 - TCP - Used to maintain a persistent connection to APNs and receive push notifications 80/443 - TCP - Provides access to the web interface for Profile Manager admin 1640 - TCP - Enrollment access to the Certificate Authority – Rich Jun 14 '12 at 18:57

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.