I don't want others on the same network (or any network!) to be able to access my machine at port 80, where I have dev websites.

I've tried adding this rule to ipfw:

deny tcp from any to any dst-port 80 in

which works, but it also stops me from being able to access my web root whenever I get a new IP (switching to a new wireless network, for example) until I refresh my network interface.

Is there a rule that I can add into ipfw or (since it's apparently deprecated) into pfctl that disallows any external traffic to port 80?

Edit: bmike's answer is just perfect. Here's what I've done, for others to see:

sudo ipfw add 00100 allow ip from any to any via lo0
sudo ipfw add 90100 deny tcp from any to any dst-port 80 in
sudo ipfw add 90100 deny tcp from any to any dst-port 443 in
sudo ipfw add 90100 deny tcp from any to any dst-port 3306 in

This allows all ports locally, but disallows any incoming connection to 80 (Apache), 443 (https), and 3306 (MySQL, which I already have handled via my.conf, but I still added this).

I don't want others on the same network (or any network!) to be able to access my machine at port 80, where I have dev websites.

I've tried adding this rule to ipfw:

deny tcp from any to any dst-port 80 in

which works, but it also stops me from being able to access my web root whenever I get a new IP (switching to a new wireless network, for example) until I refresh my network interface.

Is there a rule that I can add into ipfw or (since it's apparently deprecated) into pfctl that disallows any external traffic to port 80?

Edit: bmike's answer is just perfect. Here's what I've done, for others to see:

sudo ipfw add 00100 allow ip from any to any via lo0
sudo ipfw add 90100 deny tcp from any to any dst-port 80 in
sudo ipfw add 90100 deny tcp from any to any dst-port 443 in
sudo ipfw add 90100 deny tcp from any to any dst-port 3306 in

This allows all ports locally, but disallows any incoming connection to 80 (Apache), 443 (https), and 3306 (MySQL, which I already have restricted to localhost, but I still added this just to ensure it).

I don't want others on the same network (or any network!) to be able to access my machine at port 80, where I have dev websites.

I've tried adding this rule to ipfw:

deny tcp from any to any dst-port 80 in

which works, but it also stops me from being able to access my web root whenever I get a new IP (switching to a new wireless network, for example) until I refresh my network interface.

Is there a rule that I can add into ipfw or (since it's apparently deprecated) into pfctl that disallows any external traffic to port 80?

I don't want others on the same network (or any network!) to be able to access my machine at port 80, where I have dev websites.

I've tried adding this rule to ipfw:

deny tcp from any to any dst-port 80 in

which works, but it also stops me from being able to access my web root whenever I get a new IP (switching to a new wireless network, for example) until I refresh my network interface.

Is there a rule that I can add into ipfw or (since it's apparently deprecated) into pfctl that disallows any external traffic to port 80?

Edit: bmike's answer is just perfect. Here's what I've done, for others to see:

sudo ipfw add 00100 allow ip from any to any via lo0
sudo ipfw add 90100 deny tcp from any to any dst-port 80 in
sudo ipfw add 90100 deny tcp from any to any dst-port 443 in
sudo ipfw add 90100 deny tcp from any to any dst-port 3306 in

This allows all ports locally, but disallows any incoming connection to 80 (Apache), 443 (https), and 3306 (MySQL, which I already have handled via my.conf, but I still added this).