How do I open a specific port in the firewall? I can not use the "allow connections from application" as I want to open the port for Jenkins, that is not on the list...
4 Answers
Apple's OS X Mavericks contains three firewalls. First of all, the Application Level Firewall which can be configured using the system settings. But there is also ipfw, a packet filtering firewall like netfilter/iptables on GNU/Linux and pf (FreeBSD/OpenBSD).
You can either configure ipfw using the command line, or using a graphical front-end like the free/libre WaterRoof.
You could start with an ipfw command like:
sudo ipfw add 31010 allow tcp from any to any dst-port 8080
-
9
-
-
@user233428 It's been quite a while since I had to do this, but checking my bash history, looks like I used:
echo "rdr pass inet proto tcp from any to any port 80 -> 127.0.0.1 port 19131" | sudo pfctl -ef -Oct 20, 2020 at 21:01
I had the same issue under OS X Yosemite (10.10.3). Found this blog post that provides clear instructions. We can't use ipfw any more, as it's deprecated. Instead, use pfctl, which unfortunately lacks a nice command line way to tell it to open a port. Instead, you need to:
- Open /etc/pf.conf in a text editor.
- Add a line like this:
# Open port 8080 for TCP on all interfaces
pass in proto tcp from any to any port 8080
- Save the file.
- Load the changes with:
sudo pfctl -f /etc/pf.conf
If you need to open a udp port, change tcp to udp, if you need both, add a second line. Additional detail can be found in man pf.conf.
Also make sure your server is listening on the actual interface you want it accessible over (or all interfaces, using 0.0.0.0 or ::0), not localhost (127.0.0.1 or ::1).
-
3
-
2passing
-nto pfctl verifies the rules, and pointedly does not load them. Use just-f /etc/pf.confto load the rules. Verify they are loaded withpfctl -sr. However, while pfctl rules is necessary it does not appear by itself to be sufficient to allow access to a El Capitan on a given port. Nov 5, 2015 at 16:27 -
... One must also make sure the application is bound to the host name (not
localhost); one gets the hostname with$ hostnameon the command line. Also, one can restart the firewall, instead of rebooting, by going to System Preferences -> Security & Privacy -> Firewall -> Turn Off Firewall and then Turn On Firewall. Nov 5, 2015 at 16:36 -
ipfw is deprecated by Apple. Mountain Lion and later use pfctl.
-
7
-
If you want to add a specific port, then I think you need to edit the configuration file ( see krypted.com/mac-security/… and search for the part with 192.168). On the other hand, if you want to ensure an application is not blocked, jamfnation.jamfsoftware.com/discussion.html?id=6566 has a pretty good summary in the final comment. I still mostly use 10.6, so I haven't worked with pfctl much.– KentAug 29, 2014 at 8:10
Here's a one liner rather than requiring the user to mess around with Vim. Useful for automation.
sed -i '' -e '$a\pass in proto tcp from any to any port 8080' /etc/pf.conf; pfctl -vnf /etc/pf.conf
Or an alternative for Linux users
sed -i -e '$a\pass in proto tcp from any to any port 8080' /etc/pf.conf; pfctl -vnf /etc/pf.conf
Just make sure you change 8080 in the example to whatever you have in mind. Swap tcp with udp if you like.
ipfwbe relevant? apple.stackexchange.com/questions/33871/…