1

I followed the instructions in this answer to map port 8080 to 80 on my mac. This works a treat, except for the fact that I can no-longer access http://localhost:8080 explicitly through Chrome (it never responds).

Put differently, I can start an http server on my machine listening on port 8080, which, having remapped my ports will work when I navigate to localhost in my browser, but doesn't work if I navigate to localhost:8080.

This causes issues with certain library code that explicitly includes the server port in its http requests.

How do I configure port forwarding in such a way that both localhost:8080 and localhost will send requests to my local server?

  • If you disable the port forwarding does connecting to localhost:8080 work again? – nohillside Jul 27 '18 at 9:34
  • @nohillside is there a command to disable port forwarding quickly without turning off SIP etc.? – Ed Hinchliffe Jul 27 '18 at 13:08
  • 1
    /private/etc/pf.anchors/org.user.forwarding can be edited with SIP enabled – nohillside Jul 27 '18 at 13:36
  • @nohillside - thanks - I disabled the rules and localhost:8080 works again (obviously localhost doesn't). – Ed Hinchliffe Jul 27 '18 at 13:56
  • Hmm, ok, interesting :-) I didn't expect pf to behave like that, actually. – nohillside Jul 27 '18 at 14:03
3

Before answering your question, let me provide some background information for those unfamiliar with port forwarding on macOS: port forwarding involves replacing destination addresses and ports of incoming packets to redirect connections to different hosts and/or ports. macOS achieves port forwarding by applying rdr (redirection) rules to the packet filter device /dev/pf. For example, this rule:

rdr pass inet proto tcp from any to 213.32.64.5 port 80 -> 10.4.1.2 port 8080

forwards incoming IPv4 packets sent to 213.32.64.5:80 to 10.4.1.2:8080 (the pass keyword prevents redirected packets from being blocked by filter rules, see here for more information). To apply the rule, you can either use pfctl or modify /etc/pf.conf, as explained here. For more information on rdr rules, see man pf.conf.

Now to your question:

How do I configure port forwarding in such a way that both localhost:8080 and localhost will send requests to my local server?

To be able to access both the original and the redirected port reliably, you must exclude the destination address and port (127.0.0.1:8080) from being redirected:

echo 'no rdr inet proto tcp from 127.0.0.1 port 8080
rdr inet proto tcp from any to 127.0.0.1 port 80 -> 127.0.0.1 port 8080
' | sudo pfctl -ef -

(Tested on a clean install of macOS High Sierra 10.13.6.)

The command above will overwrite all existing rules, so I'd recommend it only for testing. You can then reload your Mac's default packet filter rules with sudo pfctl -F all -ef /etc/pf.conf and add the rules:

no rdr inet proto tcp from 127.0.0.1 port 8080
rdr inet proto tcp from any to 127.0.0.1 port 80 -> 127.0.0.1 port 8080

to pf.conf as explained here.

I followed the instructions in this answer to map port 8080 to 80 on my mac. This works a treat, except for the fact that I can no longer access http://localhost:8080 explicitly through Chrome (it never responds).

This comment on Sal Ferrarello's blog describes a similar behavior. I was able to reproduce it, but in my tests the connection to port 8080 worked intermittently, or more precisely: I could load http://127.0.0.1:8080, but after that first connection, clicking any link on the website timed out. Some time later, though, I was able to connect once again, just to experience in any subsequent connections the same time-outs as before.

I had to do quite a bit of packet sniffing, I'd like to share the commands I used to log packets that match the rdr rule (that's what the log parameter below is for) using the "pflog0" pseudo-device (see man pflog and man pf.conf for details):

echo 'no rdr log inet proto tcp from 127.0.0.1 port 8080
rdr inet log proto tcp from any to 127.0.0.1 port 80 -> 127.0.0.1 port 8080
' | sudo pfctl -ef -
sudo ifconfig pflog0 create
sudo tcpdump -X -n -e -i pflog0
  • Great answer and a working solution! Thanks for the additional detail - really useful. – Ed Hinchliffe Aug 1 '18 at 9:58
  • @EdHinchliffe I'm glad you found my answer useful! – jaume Aug 1 '18 at 10:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .