Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

I want is to set up a Mac to connect to multiple networks. So far, so good. However, I only want to grant AFP access to users on ONE of the networks, but not the other. How can I accomplish this on (non-server) Mac OS X?

This is probably an issue that comes up quite a bit in IT - you want to use the same machine as a world-facing web server and as an internal AFP (or whatever) server, but I haven't really been able to find a way to do it.

share|improve this question
    
I'm sure it has to do with binding the service to a specific IP address for listening, but I don't know enough about that to provide a good answer. –  Josh K Sep 1 '10 at 3:16
    
@Josh My thought was something with the firewall, as you could just allow/block the port to the service, but I don't know how or if it's even possible with the stock OSX firewall –  Kyle Cronin Sep 1 '10 at 3:48

1 Answer 1

up vote 3 down vote accepted

You can do this using the builtin ipfw firewall (it is not the default firewall in Snow Leopard, but it is still included). You can configure from the command line, the exact rule set you need depends on your other requirements, but the specific rule in question would be something like:

# allow AFP (port 548) traffic from 10net
/sbin/ipfw add allow tcp from 10.0.0/24 to any 548

# deny all other AFP traffic 
ipfw add deny tcp from any to any 548

Obviously you will need to adjust that for your specific network. Also, these rules are not persistent, which means you will need to add a script to run them commands every reboot. On the other hand, that means that if you wedge your networking while trying to come up with appropriate rules you can always just reboot to reset the stack. There are plenty of ipfw tutorials on the web (most of them are aimed at FreeBSD users, but it is the same interface).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.