How do I open a specific port in the firewall? I can not use the "allow connections from application" as I want to open the port for Jenkins, that is not on the list...


4 Answers 4


Apple's OS X Mavericks contains three firewalls. First of all, the Application Level Firewall which can be configured using the system settings. But there is also ipfw, a packet filtering firewall like netfilter/iptables on GNU/Linux and pf (FreeBSD/OpenBSD).

You can either configure ipfw using the command line, or using a graphical front-end like the free/libre WaterRoof.

You could start with an ipfw command like:

sudo ipfw add 31010 allow tcp from any to any dst-port 8080
  • 9
    ipfw is deprecated and gone in El Capitan Commented Aug 1, 2016 at 22:16
  • @slashdottir How can I use this command with pfctl?
    – user233428
    Commented Oct 20, 2020 at 15:07
  • @user233428 It's been quite a while since I had to do this, but checking my bash history, looks like I used: echo "rdr pass inet proto tcp from any to any port 80 -> port 19131" | sudo pfctl -ef - Commented Oct 20, 2020 at 21:01

I had the same issue under OS X Yosemite (10.10.3). Found this blog post that provides clear instructions. We can't use ipfw any more, as it's deprecated. Instead, use pfctl, which unfortunately lacks a nice command line way to tell it to open a port. Instead, you need to:

  1. Open /etc/pf.conf in a text editor.
  2. Add a line like this:

# Open port 8080 for TCP on all interfaces

pass in proto tcp from any to any port 8080

  1. Save the file.
  2. Load the changes with:

sudo pfctl -f /etc/pf.conf

If you need to open a udp port, change tcp to udp, if you need both, add a second line. Additional detail can be found in man pf.conf.

Also make sure your server is listening on the actual interface you want it accessible over (or all interfaces, using or ::0), not localhost ( or ::1).

  • 3
    Whoa, reboot? Do you really have to reboot to open a port?
    – jcollum
    Commented Aug 24, 2015 at 18:22
  • 2
    passing -n to pfctl verifies the rules, and pointedly does not load them. Use just -f /etc/pf.conf to load the rules. Verify they are loaded with pfctl -sr. However, while pfctl rules is necessary it does not appear by itself to be sufficient to allow access to a El Capitan on a given port. Commented Nov 5, 2015 at 16:27
  • ... One must also make sure the application is bound to the host name (not localhost); one gets the hostname with $ hostname on the command line. Also, one can restart the firewall, instead of rebooting, by going to System Preferences -> Security & Privacy -> Firewall -> Turn Off Firewall and then Turn On Firewall. Commented Nov 5, 2015 at 16:36
  • @Keen fantastic avatar - great memories!
    – Dónal
    Commented Jul 13, 2017 at 11:25

ipfw is deprecated by Apple. Mountain Lion and later use pfctl.


  • 7
    can you post the specific command to open a port?
    – thias
    Commented Aug 28, 2014 at 9:44
  • If you want to add a specific port, then I think you need to edit the configuration file ( see krypted.com/mac-security/… and search for the part with 192.168). On the other hand, if you want to ensure an application is not blocked, jamfnation.jamfsoftware.com/discussion.html?id=6566 has a pretty good summary in the final comment. I still mostly use 10.6, so I haven't worked with pfctl much.
    – Kent
    Commented Aug 29, 2014 at 8:10

Here's a one liner rather than requiring the user to mess around with Vim. Useful for automation.

sed -i '' -e '$a\pass in proto tcp from any to any port 8080' /etc/pf.conf; pfctl -vnf /etc/pf.conf

Or an alternative for Linux users

sed -i -e '$a\pass in proto tcp from any to any port 8080' /etc/pf.conf; pfctl -vnf /etc/pf.conf

Just make sure you change 8080 in the example to whatever you have in mind. Swap tcp with udp if you like.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .