4

For some unexplained reason, iterm2 cannot connect to (at least some) devices on my local host. I get:

ssh: connect to host 192.168.252.248 port 22: No route to host

Initially I thought this was related to SSH, but ping also doesn't work:

ping 192.168.252.248
PING 192.168.252.248 (192.168.252.248): 56 data bytes
ping: sendto: No route to host
Request timeout for icmp_seq 0

On the built-in terminal this works as expected and the browser can also connect to the device's (.248) web inteface.

The first suspect that I thought of was little snitch, but there are clearly no rules that block the traffic from iterm2. I've also turned off the network filter just to make sure it isn't related to that, to no avail. It's true that this isn't the same as uninstalling, but I doubt little snitch is the culprit here.

Of course there scope link route to 192.168.252.0/24:

192.168.252.0/24 dev en0 scope link

Although this couldn't have been the problem, given that it works from other applications.

I don't have other issues that I know of on iterm2 related to connectivity, I can connect to any other hosts without any issues, including my router's web interface.

Any ideas what iterm2 might have changed or what settings I could change that could affect this?

I'm using Mac OS Sequoia 15.0.1 and iterm2 3.5.5.

I've also uninstalled little snitch completely just to make sure this isn't interefering, but it didn't make any difference.

Improve this question
8
  • 2
    This question is similar to: How can I manually allow Local Network access for an app?. If you believe it’s different, please edit the question, make it clear how it’s different and/or how the answers on that question are not helpful for your problem.
    – Linc Davis
    Commented Oct 12 at 12:30
  • 1
    The latest version of iTerm2 on GitHub doesn’t have the multicast entitlement, so it’s not going to be able to access the local network. The IP of the router is the default route, so it’s allowed. Otherwise apps without local network permission would have no network access at all, which is not the case.
    – Linc Davis
    Commented Oct 12 at 14:20
  • 1
    @LincD.Can you explain "multicast entitlement" to the studio audience? To a network guy, "multicast" does not mean "access the local network", which would typically be unicast.
    – Marc Wilson
    Commented Oct 12 at 15:32
  • 1
    @LincD Ah, I found your answer here. Remarkably broken implementation, even for Apple. apple.stackexchange.com/questions/475737/…
    – Marc Wilson
    Commented Oct 12 at 16:39
  • 1
    My comment above is wrong. iTerm2 does have multicast entitlement; it's just not where I expected it to be in the source code.
    – Linc Davis
    Commented Oct 12 at 21:56

2 Answers 2

Reset to default
4

Local Network Privacy is a new security feature in Sequoia:

Local Network Privacy FAQ-3 (developer.apple.com)

The developer must get authorization from Apple to build a sandboxed app with a "multicast entitlement" so that it can be granted permission by the user to access the local network. Without that permission, the app can access the Internet, but not the local network.

Multicast entitlement is a new type of capability that works differently than others. It's directly managed by Apple and associated with the App ID. I don't fully understand the documentation, but the entitlement doesn't appear in the provisioning profile. See:

Provisioning with capabilities (developer.apple.com)

Improve this answer
3
  • 1
    All of Quinn “The Eskimo!”’s posts are typically gold, but this one is a superlative resource. Only tvOS lacks enforcement of this entitlement now.
    – bmike ♦
    Commented Oct 12 at 21:40
  • @bmike: An "enforced entitlement" ? Sounds like the "Brave New World" :)
    – Seamus
    Commented Oct 15 at 0:37
  • Yes @Seamus or the brave new world is already here and macOS is trying to prevent unscrupulous apps from sabotaging people that aren’t technically minded to request entitlement for operations that are known to be abused by PUPs and malware?
    – bmike ♦
    Commented Dec 14 at 21:41
3

This happened to me: After Sequoia update, my Mac has been asking me (paraphrasing) "x application wants to access devices on your network. Yes/No". I selected "No" for iTerm2 last night when I should have selected "Yes" and spent this morning Googling what went wrong when I couldn't ssh suddenly. Here's how you fix it:

In Mac System Settings, go to Privacy & Security, then Local Network. If iTerm's switch button is turned off, turn it on. It should work immediately.

Improve this answer
2
  • 1
    Thanks! Note that even though the program says "iTerm2" in the menu bar and the About dialog, it may show up as just "iTerm" in the settings. I also had to quit and restart iTerm2 for the changes to get picked up.
    – Robert
    Commented Nov 15 at 22:25
  • You save my ass,MAN.
    – iamhite
    Commented Dec 9 at 3:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .