Can't receive UDP except on `localhost`?

Question

Say I have a UDP server:

import socket

ls = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
ls.bind(('0.0.0.0', 12001))
while True:
    print('{!r}'.format(ls.recvfrom(100)))

If I attempt to send to this server with:

import socket
client = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
client.sendto(b'Test.', ('192.168.1.154', 12001))

I get a successful send, but nothing is ever emitted from the client. It doesn't matter if the packet is send locally, or from another machine on the LAN, or from a machine on the Internet (with port-forwarding set up on the router): nothing is ever received.

If I send it on localhost, I do get the packet:

client.sendto(b'Test.', ('127.0.0.1', 12001))

That packet is emitted on the server.

Changing the port doesn't change anything / I am picking 12001 specifically to be unlikely to collide. (But this is also the third such port I've chosen.)

This smells like macOS has a firewall somewhere, but where?

(a. note that we are binding to all interfaces on the UDP server. b. even if I bind to the specific interface, nothing, although the sendto to localhost no longer functions in that case, as one would expect. c. I can see the UDP packets arriving in Wireshark, so it is not a connectivity issue)

Answer 1

I had a similar situation when trying to use a virtual appliance hosted on a ubuntu server. It is likely to be a software firewall that is the issue. Look into using ipfw on your mac device. It is like iptables on linux.

Answer 2

TL;DR: JAMF.

There are apparently two firewalls in macOS? There's pfctl, commented on above, which was not my problem. There's also this:

root# /usr/libexec/ApplicationFirewall/socketfilterfw --getblockall
Firewall settings cannot be modified from command line on managed Mac computers.

That's a highly mutinous-sounding message, of course.

This seems to be the CLI version of System Settings → Network → Firewall. For me, the "Firewall" is enabled, and the switch is both greyed out, and the "Options" button is disabled, with no clear way to enable them. (There are rumors on the Internet that you should click a "lock" icon; there is no such lock icon. There are other rumors that you need to be an admin, well, I'm an admin.)

In my case, it appears to be disabled because it is being managed by JAMF, although it'd be nice if macOS's UI would just mention that. You can see this (without root!) via System Settings → Privacy & Security → Profiles, and in there, in my case, is "Security and Privacy - Firewall (2 Settings)", and then in that: "Firewall: Enabled" and "Block all incoming connections: Enabled"

Now, of course, UDP has no concept of a "connection". What appears to happen here is that all incoming UDP packets are dropped, unless there was an outgoing packet to the same IP/port within some recent, unspecified timeframe.

So all one has to do in order to permit the incoming packets is to just send a packet out. In my case, the originating end just ignores the bogus port-opening packet.

(… I'm a software engineer, and today's mission directly involves attempting to integrate with a cloud UDP service. So… yeah.)