With any luck, there's an easy work-around for this:

  • curl ifconfig.me to find your external IP address
  • sudo lsof -i4 -n | grep LISTEN | grep \* to find processes listening for connections from other machines
  • telnet EXTERNAL_IP PORT or nc -v EXTERNAL_IP PORT to see if the rest of the world can reach it, not just other machines on your network

On my fully patched 10.9.4 system with the firewall turned on, they can. That surprised me. I'd somehow decided applications needing the world to talk to them asked OS X to handle NAT-PNP or did it themselves. It never occurred to me OS X might do it for every open port not bound to

Picking on Dropbox, despite it not being their fault per se...

$ sudo lsof -i4 -n | grep LISTEN | grep \* | grep Dropbox
Dropbox 361 userid 32u IPv4 0x... 0t0 TCP *:17500 (LISTEN)

$ curl ifconfig.me

$ telnet 17500
Connected to example.com.
Escape character is '^]'.

Dropbox isn't just accessible to other machines on your network: the whole world can pound on it. How about iTunes?

$ sudo lsof -i4 -n | grep LISTEN | grep \* | grep iTunes
iTunes 8950 userid 29u IPv4 0x... 0t0 TCP *:55732 (LISTEN)
iTunes 8950 userid 31u IPv4 0x... 0t0 TCP *:daap (LISTEN)

$ telnet daap
Connected to example.com.
Escape character is '^]'.

The whole world might be able to see you like Nickelback.

TextExpander? Yep. The whole world can try to get your snippets. AirServer? Now I know how I got weird pictures popping up that one time. (Good on them for adding passcode support.) That Node.js example script that listens to instead of That, too. If you told OS X the software it could listen, it can listen.

Did you check "Automatically allow signed software to receive incoming connections"? Add all those to the list, too.

I like other machines on my home network talking to my laptop to get their TextExpander snippets and share DropBox content faster. I like my iPad talking to my laptop to display my diagrams for my co-workers. I'm not enthusiastic about the whole world talking to those same open ports.

How do I persuade OS X to not ask my router to punch holes for every single open port?

  • FWIW, I've configured Little Snitch to automatically deny attempts if I don't respond. That also applies to outbound connections, crippling software auto-updates etc. Aah, well. – Garth Kidd Jul 17 '14 at 6:20
  • 1
    What makes you think the port forwarding has been set up using NAT-PMP? And what makes you think it is Mac OS X (what component?) doing it? Just curious, because I couldn't see any evidence or indication supporting this claim. – Markus Hallmann Aug 23 '14 at 21:53
  • telnet EXTERNAL_IP PORT from the LAN side might be forwarded by the router directly to the LAN address. I've seen routers in which you could disable that kind of forwarding (though that doesn't explain how the router knows to which LAN address should it forward the connection). I'd try connecting from the WAN side to avoid that possibility. Or disable NAT-PMP on the router and see whether you can still connect. Also, make sure that you're not in the DMZ ;). – hmijail May 3 '17 at 19:34

You must log in to answer this question.

Browse other questions tagged .