10

I'm running macOS Sierra 10.12.4 and am trying to open a port (12345). I can't use the GUI firewall tool as it's app specific, not port specific.

I have tried the following this article, but it did not work. When I run sudo pfctl -f /etc/pf.conf I get:

pfctl: Use of -f option, could result in flushing of rules
present in the main ruleset added by the system at startup.
See /etc/pf.conf for further details.

No ALTQ support in kernel
ALTQ related functions disabled

It may also help to note that in my firewall (GUI) options I have blocked pretty much all options as shown below.

enter image description here

Improve this question

2 Answers 2

Reset to default
7

The linked How-to is wrong!

You simply can't open a port in a firewall. You can block a port or not. By default pf is disabled and doesn't block anything. If you enable stealth mode in the Application Firewall, pf will be enabled via the com.apple/250.ApplicationFirewall anchor with a very limited set of rules:

scrub in all fragment reassemble
block drop in inet proto icmp all icmp-type echoreq
block drop in inet proto icmp all icmp-type echoreq
block drop in inet6 proto ipv6-icmp all icmp6-type echoreq

Except incoming IPv4/6 ICMP echo request, pf won't block anything. The default pf.conf doesn't contain any block all ... or allow all ... rules.

To open a port on your host, you have to launch an app which opens a listening port. Example nc:

nc -l 12345

After entering the command you will be asked to accept incoming network connections for nc by the Application Firewall.

To connect to nc listening at port 12345 from remote simply enter nc hostname 12345 on a second host (replace hostname with the host name of the Mac running nc).

You can check open ports from remote by entering nmap hostname -Pn (if stealth mode is enabled).

Improve this answer
1
  • 1
    I think it's quite commonly understood that by "open a port in the firewall", people typically mean "unblock a port".
    – Adrian Schmidt
    Oct 19, 2018 at 13:19
0

You need to enable the firewall first. In System Preferences >> Security and Privacy under the Firewall tab, tick the box to enable it (you will have to unlock first).

enter image description here

Alternativily, you can do this via Terminal:

$ sudo pfctl -E

Once you enable the firewall, you shouldn't get the No ALTQ support in kernel error message.

Improve this answer
2
  • 2
    "No ALTQ" is a limitation of the kernel. You will always get this message in macOS after enabling pf. The application firewall of the OP is already enabled or he wouldn't be able to see the firewall options.
    – klanomath
    May 9, 2017 at 15:05
  • @klanomath - Did this change for Sierra? This is how I fixed this issue once before....
    – Allan
    May 9, 2017 at 15:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .