Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

I am a Linux user and very new to OSX. I have an OSX 10.7.5 "Lion" server that I am configuring as a webserver. I only have shell access.

I am tryin to configure the firewall, but ipfw is quite different from iptables. Currently, all ports are open to the world. I would like to add the following rules:

  • port 80/443: allow incoming connections from any IP address.
  • anything else: only allow incoming connections from within current subnet.

How would I accomplish this with ipfw?

share|improve this question
    
If you you can use Server Admin Tools, it would be much easier to achieve what you need. If you really want to use the command line, here are some starting points (can't write a complete answer as I can't test it right now): for firewall rules you can use any FreeBSD IPFW manual, keep in mind that ipfw is /sbin/ipfw on OS X. However, setting up the rules to load on startup requires for example setting StartupItems (as at the bottom of ibiblio.org/macsupport/ipfw). And make sure that the rules that you set up don't lock you out from the machine (e.g. if you are not on local network) –  lupincho Dec 23 '12 at 18:11
    
ipfw is deprecated on OS X. You should use pf, see pfctl(8). –  MacLemon Jun 22 at 13:12
add comment

1 Answer 1

Although you seem fine handling the command line, on OS X it is best to use the Server Admin Tools (like @lupincho suggested). But how can you use the Server Admin Tools GUI when you only have terminal acces?

You can run the Server Admin Tools app from another mac, this will allow you to login on a remote server and change it's settings. If you do not have a spare mac with the Server Admin Tools installed, you can do the following:

  1. SSH into your remote OS X machine with an administrator’s log in and password.

  2. Enable Remote Desktop (a.k.a. Screen Sharing, a.k.a. VNC) with this command:

sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -activate -configure -access -on -clientopts -setvnclegacy -vnclegacy yes -clientopts -setvncpw -vncpw mypasswd -restart -agent -privs -all

3) Login using a VNC client (such as TightVNC). Your password is "mypasswd" (see the -vncpw flag in the above command; you can — and should — change this).

Now you can open the Server Admin Tools and do your thing.

4) When you are done, turn of screen sharing using your SSH session:

sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -deactivate -configure -access -off

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.