0

Say I have a UDP server:

import socket

ls = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
ls.bind(('0.0.0.0', 12001))
while True:
    print('{!r}'.format(ls.recvfrom(100)))

If I attempt to send to this server with:

import socket
client = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
client.sendto(b'Test.', ('192.168.1.154', 12001))

I get a successful send, but nothing is ever emitted from the client. It doesn't matter if the packet is send locally, or from another machine on the LAN, or from a machine on the Internet (with port-forwarding set up on the router): nothing is ever received.

If I send it on localhost, I do get the packet:

client.sendto(b'Test.', ('127.0.0.1', 12001))

That packet is emitted on the server.

Changing the port doesn't change anything / I am picking 12001 specifically to be unlikely to collide. (But this is also the third such port I've chosen.)

This smells like macOS has a firewall somewhere, but where?

(a. note that we are binding to all interfaces on the UDP server. b. even if I bind to the specific interface, nothing, although the sendto to localhost no longer functions in that case, as one would expect. c. I can see the UDP packets arriving in Wireshark, so it is not a connectivity issue)

2
  • 1
    Start by ensuring the firewall is disabled pfctl -d It’s not enabled by default, but it could have been enabled at some point.
    – Allan
    Apr 26, 2023 at 21:26
  • I disabled it with pfctl -d, still no change in behavior, though. It was, however, enabled.
    – Thanatos
    Apr 28, 2023 at 19:27

2 Answers 2

1

I had a similar situation when trying to use a virtual appliance hosted on a ubuntu server. It is likely to be a software firewall that is the issue. Look into using ipfw on your mac device. It is like iptables on linux.

2
  • It seems that macOS ditched ipfw some time ago. pf is apparently the new hotness; AFAICT, it hasn't any rules, though if someone can supply a more direct command that would tell one way or another, I can post that.
    – Thanatos
    Apr 26, 2023 at 21:27
  • See my comment on the question @Thanatos. The command to disable pf is pfctl -d.
    – Allan
    Apr 26, 2023 at 22:12
0

TL;DR: JAMF.

There are apparently two firewalls in macOS? There's pfctl, commented on above, which was not my problem. There's also this:

root# /usr/libexec/ApplicationFirewall/socketfilterfw --getblockall
Firewall settings cannot be modified from command line on managed Mac computers.

That's a highly mutinous-sounding message, of course.

This seems to be the CLI version of System Settings → Network → Firewall. For me, the "Firewall" is enabled, and the switch is both greyed out, and the "Options" button is disabled, with no clear way to enable them. (There are rumors on the Internet that you should click a "lock" icon; there is no such lock icon. There are other rumors that you need to be an admin, well, I'm an admin.)

In my case, it appears to be disabled because it is being managed by JAMF, although it'd be nice if macOS's UI would just mention that. You can see this (without root!) via System Settings → Privacy & Security → Profiles, and in there, in my case, is "Security and Privacy - Firewall (2 Settings)", and then in that: "Firewall: Enabled" and "Block all incoming connections: Enabled"

Now, of course, UDP has no concept of a "connection". What appears to happen here is that all incoming UDP packets are dropped, unless there was an outgoing packet to the same IP/port within some recent, unspecified timeframe.

So all one has to do in order to permit the incoming packets is to just send a packet out. In my case, the originating end just ignores the bogus port-opening packet.

(… I'm a software engineer, and today's mission directly involves attempting to integrate with a cloud UDP service. So… yeah.)

1
  • JAMF is an MDM (Mobile Device Management) product that your company (by way of the IT department) has deployed to ensure compliance with policies. In this case, they have locked down the network to all unknown traffic. There’s no getting around this. You need to have your IT support staff deploy a policy to open these ports up to you.
    – Allan
    Apr 28, 2023 at 22:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .