15

How do I open a specific port in the firewall? I can not use the "allow connections from application" as I want to open the port for Jenkins, that is not on the list...

7

Apple's OS X Mavericks contains three firewalls. First of all, the Application Level Firewall which can be configured using the system settings. But there is also ipfw, a packet filtering firewall like netfilter/iptables on GNU/Linux and pf (FreeBSD/OpenBSD).

You can either configure ipfw using the command line, or using a graphical front-end like the free/libre WaterRoof.

You could start with an ipfw command like:

sudo ipfw add 31010 allow tcp from any to any dst-port 8080
  • 7
    ipfw is deprecated and gone in El Capitan – slashdottir Aug 1 '16 at 22:16
21

I had the same issue under OS X Yosemite (10.10.3). Found this blog post that provides clear instructions. We can't use ipfw any more, as it's deprecated. Instead, use pfctl, which unfortunately lacks a nice command line way to tell it to open a port. Instead, you need to:

  1. Open /etc/pf.conf in a text editor.
  2. Add a line like this:

# Open port 8080 for TCP on all interfaces

pass in proto tcp from any to any port 8080

  1. Save the file.
  2. Load the changes with:

sudo pfctl -f /etc/pf.conf

If you need to open a udp port, change tcp to udp, if you need both, add a second line. Additional detail can be found in man pf.conf.

Also make sure your server is listening on the actual interface you want it accessible over (or all interfaces, using 0.0.0.0 or ::0), not localhost (127.0.0.1 or ::1).

  • 3
    Whoa, reboot? Do you really have to reboot to open a port? – jcollum Aug 24 '15 at 18:22
  • 1
    passing -n to pfctl verifies the rules, and pointedly does not load them. Use just -f /etc/pf.conf to load the rules. Verify they are loaded with pfctl -sr. However, while pfctl rules is necessary it does not appear by itself to be sufficient to allow access to a El Capitan on a given port. – Brian M. Hunt Nov 5 '15 at 16:27
  • ... One must also make sure the application is bound to the host name (not localhost); one gets the hostname with $ hostname on the command line. Also, one can restart the firewall, instead of rebooting, by going to System Preferences -> Security & Privacy -> Firewall -> Turn Off Firewall and then Turn On Firewall. – Brian M. Hunt Nov 5 '15 at 16:36
  • @Keen fantastic avatar - great memories! – Dónal Jul 13 '17 at 11:25
6

ipfw is deprecated by Apple. Mountain Lion and later use pfctl.

http://support.apple.com/kb/ht5413

  • 5
    can you post the specific command to open a port? – thias Aug 28 '14 at 9:44
  • If you want to add a specific port, then I think you need to edit the configuration file ( see krypted.com/mac-security/… and search for the part with 192.168). On the other hand, if you want to ensure an application is not blocked, jamfnation.jamfsoftware.com/discussion.html?id=6566 has a pretty good summary in the final comment. I still mostly use 10.6, so I haven't worked with pfctl much. – Kent Aug 29 '14 at 8:10
1

Here's a one liner rather than requiring the user to mess around with Vim. Useful for automation.

sed -i '' -e '$a\pass in proto tcp from any to any port 8080' /etc/pf.conf; pfctl -vnf /etc/pf.conf

Or an alternative for Linux users

sed -i -e '$a\pass in proto tcp from any to any port 8080' /etc/pf.conf; pfctl -vnf /etc/pf.conf

Just make sure you change 8080 in the example to whatever you have in mind. Swap tcp with udp if you like.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .