With any luck, there's an easy work-around for this:
curl ifconfig.meto find your external IP address
sudo lsof -i4 -n | grep LISTEN | grep \*to find processes listening for connections from other machines
telnet EXTERNAL_IP PORTor
nc -v EXTERNAL_IP PORTto see if the rest of the world can reach it, not just other machines on your network
On my fully patched 10.9.4 system with the firewall turned on, they can. That surprised me. I'd somehow decided applications needing the world to talk to them asked OS X to handle NAT-PNP or did it themselves. It never occurred to me OS X might do it for every open port not bound to
Picking on Dropbox, despite it not being their fault per se...
$ sudo lsof -i4 -n | grep LISTEN | grep \* | grep Dropbox Dropbox 361 userid 32u IPv4 0x... 0t0 TCP *:17500 (LISTEN) $ curl ifconfig.me 220.127.116.11 $ telnet 18.104.22.168 17500 Trying 22.214.171.124... Connected to example.com. Escape character is '^]'.
Dropbox isn't just accessible to other machines on your network: the whole world can pound on it. How about iTunes?
$ sudo lsof -i4 -n | grep LISTEN | grep \* | grep iTunes iTunes 8950 userid 29u IPv4 0x... 0t0 TCP *:55732 (LISTEN) iTunes 8950 userid 31u IPv4 0x... 0t0 TCP *:daap (LISTEN) $ telnet 126.96.36.199 daap Trying 188.8.131.52... Connected to example.com. Escape character is '^]'.
The whole world might be able to see you like Nickelback.
TextExpander? Yep. The whole world can try to get your snippets. AirServer? Now I know how I got weird pictures popping up that one time. (Good on them for adding passcode support.) That Node.js example script that listens to
0.0.0.0 instead of
127.0.0.1? That, too. If you told OS X the software it could listen, it can listen.
Did you check "Automatically allow signed software to receive incoming connections"? Add all those to the list, too.
I like other machines on my home network talking to my laptop to get their TextExpander snippets and share DropBox content faster. I like my iPad talking to my laptop to display my diagrams for my co-workers. I'm not enthusiastic about the whole world talking to those same open ports.
How do I persuade OS X to not ask my router to punch holes for every single open port?