2

I am a Linux user and very new to OSX. I have an OSX 10.7.5 "Lion" server that I am configuring as a webserver. I only have shell access.

I am tryin to configure the firewall, but ipfw is quite different from iptables. Currently, all ports are open to the world. I would like to add the following rules:

  • port 80/443: allow incoming connections from any IP address.
  • anything else: only allow incoming connections from within current subnet.

How would I accomplish this with ipfw?

Improve this question
2
  • If you you can use Server Admin Tools, it would be much easier to achieve what you need. If you really want to use the command line, here are some starting points (can't write a complete answer as I can't test it right now): for firewall rules you can use any FreeBSD IPFW manual, keep in mind that ipfw is /sbin/ipfw on OS X. However, setting up the rules to load on startup requires for example setting StartupItems (as at the bottom of ibiblio.org/macsupport/ipfw). And make sure that the rules that you set up don't lock you out from the machine (e.g. if you are not on local network)
    – lupincho
    Commented Dec 23, 2012 at 18:11
  • ipfw is deprecated on OS X. You should use pf, see pfctl(8).
    – MacLemon
    Commented Jun 22, 2014 at 13:12

1 Answer 1

Reset to default
1

Although you seem fine handling the command line, on OS X it is best to use the Server Admin Tools (like @lupincho suggested). But how can you use the Server Admin Tools GUI when you only have terminal acces?

You can run the Server Admin Tools app from another mac, this will allow you to login on a remote server and change it's settings. If you do not have a spare mac with the Server Admin Tools installed, you can do the following:

  1. SSH into your remote OS X machine with an administrator’s log in and password.

  2. Enable Remote Desktop (a.k.a. Screen Sharing, a.k.a. VNC) with this command:

sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -activate -configure -access -on -clientopts -setvnclegacy -vnclegacy yes -clientopts -setvncpw -vncpw mypasswd -restart -agent -privs -all

3) Login using a VNC client (such as TightVNC). Your password is "mypasswd" (see the -vncpw flag in the above command; you can — and should — change this).

Now you can open the Server Admin Tools and do your thing.

4) When you are done, turn of screen sharing using your SSH session:

sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -deactivate -configure -access -off

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .