1

These ports, crucial to iMessage and Facetime, are blocked: TCP Ports 80, 443, and 5223 on macOS Sierra 10.12.2 (MacBookPro11,3). (https://support.apple.com/en-us/HT202078)

In Network Utility, I perform a scan and the only Open Port is 631.

When I run:

python -m SimpleHTTPServer 80

I get a few calls then it reads that:

socket.error: [Errno 13] Permission denied

A few other terminal commands return similar responses.

Is there a method I can use to find the culprit that is blocking these ports (and likely others) on OSX? These ports specifically are needed for iMessage and Facetime.

I do not have Sophos or any other Firewall (that I know of).

  • 3
    If something was blocking 80 & 443 you wouldn't have been able to write this question :/ – Tetsujin Jan 22 '17 at 7:55
  • :80 and :443 are for web servers, and web servers over SSL. They are not crucial to iMessage for Facetime. And as has already been answered, the problem with python is you need to be root to bind to low numbered ports. – l008com Mar 23 '18 at 11:35
5

There are two things you confuse:

  • FaceTime and iMessage require communication on ports specified in the article for outbound connections.

  • Your "Permission denied" message is related to opening the port 80 for inbound connections. It's not because of any process blocking it, but if you want to make a process listen on a port less than 1024, you need to use root, so:

    sudo python -m SimpleHTTPServer 80
    
  • Yes, I need to see whats blocking 80, 443, and 5223 likely using a pfctl command? – typosruinjokes Jan 22 '17 at 6:05
  • 3
    Why do you claim "something is blocking"? – techraf Jan 22 '17 at 6:06
4

Your questions as well as other questions reveal a misconception what blocked/non-blocked or closed/open ports are.

If you want to provide a service in a network you need a process usually connected to a network socket and related addresses consisting of the local address (i.e. IP-address) and (for TCP and UDP) a port number.

So serving a website requires a process (e.g. httpd or in your example python), a socket and a related address and port (and some content). The standard port of a web server is 80.

As soon as you start a simple web server with sudo python -m SimpleHTTPServer 80 (port numbers less than 1024 have to be run as root) the port will be opened and you can access this from another host or locally.

To get open ports of a host you can install and launch nmap. The command to get all open TCP ports of an IP is:

nmap IP

or all open TCP and (most) UDP ports

sudo nmap -sT -sU IP

On a vanilla macOS Client system and after starting Python's simple HTTP server (which is attached to all internal interfaces: localhost, en0 with the IP 192.168.0.2 here,...) you will get following nmap results launched on the local host and no local firewall enabled:

nmap 127.0.0.1   
Starting Nmap 7.31 ( https://nmap.org ) at 2017-01-22 22:12 CET
Nmap scan report for 127.0.0.1
Host is up (0.0043s latency).
Not shown: 750 closed ports, 249 filtered ports
PORT   STATE SERVICE
80/tcp open  http

nmap 192.168.0.2    
Starting Nmap 7.31 ( https://nmap.org ) at 2017-01-22 22:12 CET
Nmap scan report for 192.168.0.2
Host is up (0.0043s latency).
Not shown: 750 closed ports, 249 filtered ports
PORT   STATE SERVICE
80/tcp open  http

After stopping the Python server you won't get any open TCP port though no firewall is enabled! Your Mac just doesn't provide any services. Vanilla macOS client hosts usually don't have any open TCP ports. You can enable some though: e.g. ssh on port 22. BTW if you detect an open port 631 then it's printer sharing (which is a service again).

sudo nmap -sT -sU 127.0.0.1
Starting Nmap 7.31 ( https://nmap.org ) at 2017-01-22 22:18 CET
Nmap scan report for localhost (127.0.0.1)
Host is up (0.00019s latency).
Not shown: 1891 closed ports, 78 open|filtered ports, 29 filtered ports
PORT    STATE SERVICE
80/tcp  open  http
123/udp open  ntp

sudo nmap -sT -sU 192.168.0.2
Starting Nmap 7.31 ( https://nmap.org ) at 2017-01-22 22:19 CET
Nmap scan report for 192.168.0.2
Host is up (0.00019s latency).
Not shown: 1811 closed ports, 186 open|filtered ports
PORT     STATE SERVICE
80/tcp   open  http
123/udp  open  ntp
5353/udp open  zeroconf

A closed port means: no service is running on portX. The other meanings of the different port states are explained here: Port Scanning Basics.

A port scan of 192.168.0.2 from another host in the same network will yield the same results.


In a SOHO network you usually find the following devices:

host1--------(switch-router(firewall))--------WAN/Internet
               |
host2-----------

Each of the hosts may have an (enabled) firewall or packet filter, the router usually always has an enabled firewall.

After starting your Python web server on host1 you will be able to detect the open port 80 scanning from host1 and host2. You can't detect any open port on the local hosts from the WAN because the LAN is protected by the router's firewall (and not reachable due to its private nature).

After enabling a firewall1 on host1 (with the pf example rule block drop any to any port 80) you won't be able to detect or access the still open port 80 scanning with host2 because the firewall1 blocks access.

Now relaunch the Python server with port 8080. Now you will detect no open port 80 but an open port 8080 from both hosts. The firewall1 only blocks port 80 and access is possible from host2. If you additionally add a port-forwarding rule (= punching a hole in the router's firewall) forward incoming packets to port 10080 to host1 port 8080 you will get the following results:

  • scanning from the WAN you will get an open port 10080 (though no open port 10080 exists on the LAN's hosts)
  • scanning from the LAN you will still detect an open port 8080 on host1

Get the state of a hosts` firewalls:

  • pf: enter sudo pfctl -s all | grep Status. If you get "enabled" additionally enter sudo pfctl -vnf /etc/pf.conf to get all anchors and rules. If you don't see any blocking rule (the default OS X pf state) nothing is blocked.
  • Murus: check the traffic light in the upper right corner
  • Application Firewall: on/off in System Preferences > Security > Firewall
  • Little Snitch: check any outgoing blocking rule
  • Other Firewalls (like NetBarrier) usually check some on/off switches

iMessages doesn't require any open service port on your Mac. Since iMessages tries to establish a keep-alive connection to some Apple servers it would be blocked by a host's or the router's firewall (or a dedicated firewall) though, if either of them blocks outgoing traffic to these servers on the ports 80, 443, and 5223 - and/or the incoming Apple Push Notification Service (IIRC this only possible with deep packet inspection & mitm).

In comparison, starting the Messages service in macOS Server will open the ports 80, 443 and 5222 on the server host.


Reading all your similar questions concerning iMessages I don't think your problem is related to your host's macOS but either to some kind of installed Endpoint Protection or a very restrictive firewall in the network. Or your IP/device/account is blocked by Apple!

  • @typosruinjokes No and yes! If you have enabled Printer Sharing in System Prefs > Sharing, the port 631 will be opened to allow other hosts to print via your Mac on the printer. <cmd> 127.0.0.2 (with <cmd>= ping or nmap shouldn't work at all, if you haven't added it to the /ect/hosts file or added it with ìfconfig. – klanomath Jan 23 '17 at 13:29
  • Thanks for this. Sorry for the delayed response -- I've been sick. Before I read, I want to remind you that we (Apple Engineer assistant in Cupertino and I) are certain the issue is with this OSX install, not the network or hardware. We installed a fresh OS X on a partition on this computer's internal HDD. It was able, through the same network/router/IP address, log into iMessages with the Apple ID and work flawlessly. Same with other devices on the network. My only suspicion is that the VPN PIA has an OSX client that has caused others trouble of similar nature. – typosruinjokes Jan 24 '17 at 9:22
  • @typosruinjokes Hmm what are the differences between the two OS X installs? Different versions (e.g. vanilla=Sierra=iMessages working, "corporate install"=El Capitan& Active Directory? or OD integration? & VPN=iMessages not working)? It would be helpful to mention all differences and provide more informations in your questions. E.g. reading your question and comments it's the first time you mention a VPN client install. – klanomath Jan 24 '17 at 11:51
  • It was a plain old identical install on the machine. Sierra 10.12.2. I installed it with the Apple Engineer asst who wanted to make sure it was the OS (not network or hardware). And it was. re: VPN client. Forget it. I only mention the VPN client because MAYBE it changed a setting. I uninstalled it a while ago. Just the other day I saw on a forum that it caused a few people issues (not this issue) so I mentioned it. I sent the Apple Engineer Asst. this convo to review. We speak again on Thursday. Let's try to solve this before he can! – typosruinjokes Jan 25 '17 at 3:38
  • This is new: Starting Nmap 7.01 ( https://nmap.org ) at 2017-01-24 22:43 EST Nmap scan report for localhost (127.0.0.1) Host is up (0.00040s latency). Not shown: 1993 closed ports PORT STATE SERVICE 631/tcp open ipp 8080/tcp filtered http-proxy 8443/tcp filtered https-alt 123/udp open ntp 137/udp open|filtered netbios-ns 138/udp open|filtered netbios-dgm 5353/udp open|filtered zeroconf – typosruinjokes Jan 25 '17 at 3:45
1

You can check to see if the ports are already in use by another application by using the command lsof -Pn -i4 | grep :YOURPORT. For example, when I run it I get:

$ lsof -Pn -i4 | grep :9300

testApp 66479 username 8u IPv4 0x176881bf1af12e39 0t0 UDP *:9300

This shows me that 'testApp' is listening on port 9300 under 'username'.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .