2

I am trying to follow up on this thread and to update it for macOS Sierra (and probably all versions since Yosemite).

In that thread, a way to open a single port in the OS's firewall was suggested: 

sudo ipfw add 40000 allow tcp from any to any dst-port portnum

However, since Yosemite, ipfw was replaced with pf and, unless I am mistaken, pfctl should therefore be used.

What would the above command translate to?

Improve this question

1 Answer 1

Reset to default
2

To open a port you would use the following line(s):

pass in proto tcp from any to any port 40000
pass in proto tcp from any to any port 80
pass in proto {tcp, udp} from any to any port 53
pass in from any to any port 3601

To quick-start pf and open a port with one of the lines above use e.g.:

echo "pass in proto tcp from any to any port 40000" | sudo pfctl -ef -

To test the rule(s) use: sudo pfctl -s rules

After a reboot you would have to enter the command again, because pf is not started automatically.

By default the pf.conf file has no blocking all rule. So even after starting pf with sudo pfctl -e nothing is blocked.

If you don't want to dive deeply into pf/pf.conf/pfctl, I recommend to use a pfctl GUI like the free Murus Lite to configure pf.

Improve this answer
2
  • Mac OS Sierra keeps complaining about pfctl interfering with internal firewall by flushing rules that have been set on startup. What? Are there different firewalls? How come? ... As a conclusion this sounds pretty ridiculous to me as it renders to be unnecessarily painful to do something as simple as open a port for incoming connections, in my case to expose homebrewn dnsmasq to local network under Sierra. (With this "application" not listed as application to be enabled the common way.)
    – Thomas Urban
    Apr 4, 2017 at 8:20
  • @cepharum macOS Sierra provides two different firewalls: pf (no Apple GUI) and the Application Firewall (System Prefs > Security > Firewall). Feel free to ask a separate question covering your problem.
    – klanomath
    Apr 4, 2017 at 8:36

You must log in to answer this question.