How can one configure the Firewall on macOS Sierra 10.12 to open up a single port (in this case port 3690)?

There's no obvious UI to do this.

  • 1
    Which firewall do you want to configure: application firewall or pf? – klanomath Nov 3 '16 at 11:50
  • 1
    TBH, don't know - just know that Subversion (port 3690) works when the firewall's turned off, but doesn't when it's on. Am running svnshare for some code running in a VMWare VM on this machine (question apple.stackexchange.com/questions/259633/…) – GlennG Nov 3 '16 at 12:08

If you are using Sierra's Application Firewall you can't restrict it to a single port.

To allow incoming traffic for a specific binary, open System Preferences > Security & Privacy > Firewall > Firewall Options and either hit the plus button and choose the binary or drop the binary from a Finder window.

In my example below I have chosen the X11 binary in /Applications/Utilities/XQuartz.app/Contents/MacOS/enter image description here

You can the check additional apps added by executing:

sudo /usr/libexec/ApplicationFirewall/socketfilterfw --listapps

After adding Xcode, anything starting with svn in /usr/bin/ and /Applications/Xcode.app/Contents/Developer/usr/bin/ and starting /usr/bin/svnserve I was asked once to allow incoming traffic for svnserve (I don't know which of both svnserve executables) and it worked from remote. After removing everything and repeating the same steps it failed again.

The log file at /var/log stays empty and the other logs don't reveal anything related to blocked incoming connections.

I recommend to enable ssh and create a ssh:svn-tunnel. Link: Subversion through a tunnel

As an alternative install Murus - a GUI for pf. If you don't activate it with an email and a serial number it will run as the free Murus Lite.

Open the app and choose a strategy. E.g. Novice > Predefined Firewall Configuration Presets > Almost all services blocked. Then activate the selected Murus preset and start pf.

Hit the library button. In the services library panel hit the gear

add custom service

and add a new custom service SVN:

SVN service

In the groups library hit the gear and add new custom group

add custom group

Hit the loupe, enter a group name, add an appropriate interface, hit the plus button and add an IP or network.

configure custom group

Drag the SVN service to the main windows (Managed inbound services) and configure it:

Managed inbound services

If you have additional services like SSH running, add them also. Start or restart pf if necessary. Now - protected by pf - you may dissable the application firewall.

  • Can/does the packet filter work in conjunction with the firewall? i.e. adding a specific port to that using pfctl? – GlennG Nov 3 '16 at 13:16
  • Tried adding svnserve but it's still blocked (e.g. try to connect, can't, turn off firewall, connect, works). /usr/bin/svnserve ( Allow incoming connections ) – GlennG Nov 3 '16 at 13:29
  • There's also one in (whereis svnserve) /usr/bin/svnserve - and thanks. I'm developing .net applications in Visual Studio within a VMWare VM on "my" machine, hence just need to connect from the VM to the host. Currently that's on the 172.16.x.x address range – GlennG Nov 3 '16 at 14:07
  • OIC - all about 18k. Killed svnserve and started the Xcode version (ps shows /Applications/Xcode.app/Contents/Developer/usr/bin/svnserve -d -r /Users/GlennG/svnRepo). Added this to the firewall /Applications/Xcode.app/Contents/Developer/usr/bin/svnserve ( Allow incoming connections ). Again same issue: doesn't work from the VM using Tortoise, turn off Mac firewall then it works. – GlennG Nov 3 '16 at 14:33
  • 1
    @GlennG I would like to rant about Apple, Sierra and the flawed log system now, but I probably would be banned or the comment would be flagged as inappropriate. I can comprehend your problems but I can't find any log nor log entry in the whole system (ASL/log/new log database) and I don't really know what's blocked. – klanomath Nov 3 '16 at 18:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .