0

Any attempt to connect to a server over port 143 is blocked by the OS. I've verified it's not my connection; other computers on the network can see the port just fine. I've replicated the problem on a different network, as well as both the Ethernet and Wifi interfaces.

On my Macbook, I get this:

$ telnet mail.xxxx.com 143
Trying xxx.xxx.xxx.xxx...
telnet: connect to address xxx.xxx.xxx.xxx: Permission denied
telnet: Unable to connect to remote host

$ telnet mail.xxxx.com 110
Trying xxx.xxx.xxx.xxx...
Connected to mail.xxxx.com.
Escape character is '^]'.
+OK Welcome to MailEnable POP3 Server

On another computer on the same network:

$ telnet mail.xxxx.com 143
Trying xxx.xxx.xxx.xxx...
Connected to mail.xxxx.com.
Escape character is '^]'.
* OK IMAP4rev1 server ready at 07/28/11 19:53:15

The problem is due to a lot of extraneous ipfw rules:

$ sudo ipfw show
00010   1166    210912 allow ip from any to any via lo*
00100      0         0 deny ip from 127.0.0.0/8 to any in
00110      0         0 deny ip from any to 127.0.0.0/8 in
00120      0         0 deny ip from 224.0.0.0/3 to any in
00130      0         0 deny tcp from any to 224.0.0.0/3 in
10010      0         0 check-state
10020    163     12011 deny ip from any to any established in
10030      0         0 deny ip from any to any frag in
20000     14       784 skipto 50000 icmp from any to any out keep-state
20010 227761 225019565 skipto 50000 tcp from any to any dst-port 80,8080 out setup keep-state
20011   7994   1700223 skipto 50000 tcp from any to any dst-port 443,8443 out setup keep-state
20020      0         0 skipto 50000 tcp from any to any dst-port 53 out setup keep-state
20020   1359    125457 skipto 50000 udp from any to any dst-port 53 out keep-state
20030    150     17801 skipto 50000 tcp from any to any dst-port 110,993 out setup keep-state
20031      0         0 skipto 50000 tcp from any to any dst-port 25,465,587 out setup keep-state
20040    501     54357 skipto 50000 tcp from any to any dst-port 22 out setup keep-state
20050      0         0 skipto 50000 tcp from any to any dst-port 21 out setup keep-state
20060      0         0 skipto 50000 tcp from any to any dst-port 123 out setup keep-state
20060     12       912 skipto 50000 udp from any to any dst-port 123 out keep-state
20070      0         0 skipto 50000 tcp from any to any dst-port 113 out setup keep-state
20070      0         0 skipto 50000 udp from any to any dst-port 113 out keep-state
20080      0         0 skipto 50000 tcp from any to any dst-port 194 out setup keep-state
20080      0         0 skipto 50000 udp from any to any dst-port 194 out keep-state
20090      0         0 skipto 50000 tcp from any to any dst-port 137-139,445 out setup keep-state
20090    214     28854 skipto 50000 udp from any to any dst-port 137-139,445 out keep-state
20100      0         0 skipto 50000 tcp from any to any dst-port 1194 out setup keep-state
20100      0         0 skipto 50000 udp from any to any dst-port 1194 out keep-state
20110      0         0 skipto 50000 tcp from any to any dst-port 111,2049 out setup keep-state
20110      0         0 skipto 50000 udp from any to any dst-port 111,2049 out keep-state
20120      0         0 skipto 50000 tcp from any to any dst-port 6881-6999 out setup keep-state
30000      0         0 allow tcp from any to me dst-port 22 in setup keep-state
30010      0         0 allow udp from any to me dst-port 67,68 in keep-state
30020      0         0 allow icmp from 192.168.0.2 to any in keep-state
40000   1284    289790 deny ip from any to any
50000 238005 226947953 allow ip from any to any
65535     25      7914 allow ip from any to any

I cannot find where these settings are coming from, disabling the firewall has no effect.

Improve this question

2 Answers 2

Reset to default
1

I cleared them out with:

$ sudo ipfw -f flush

But this is only a temporary fix, and I have no idea where these rules are coming from.

I've discovered that disabling the ruleset they belong to lasts longer:

$ sudo ipfw set disable 0

But they still get re-enabled after a reboot.

Improve this answer
5
  • I upgraded from 10.6 to Lion; I don't have any of these in my table.
    – NReilingh
    Commented Jul 29, 2011 at 1:18
  • @NReilingh this was so weird. It was blocking my network printer as well. Still have no idea where they came from.
    – Adam Lassek
    Commented Jul 29, 2011 at 2:24
  • @NReilingh I even did a fresh install of Lion, wiped my partition first.
    – Adam Lassek
    Commented Jul 29, 2011 at 2:25
  • 1
    The ipfw rule list isn't even preserved across reboots, so it must've been something installed on the computer, running at startup, setting up the rule list. Wiping and reinstalling will fix that...
    – Gordon Davisson
    Commented Jul 29, 2011 at 3:06
  • @Gordon You're right, a flush is only a temporary measure. Where could rules be stored? I don't have /etc/firewall.conf and I can't find a plist for it.
    – Adam Lassek
    Commented Jul 30, 2011 at 11:11
-1

They are coming from /etc/ipfilter/*

Improve this answer
1
  • 1
    Nope. OSX doesn't have /etc/ipfilter
    – Adam Lassek
    Commented Jan 24, 2012 at 21:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .