86

To forward all port 80 traffic to port 8080, you can enter the following from the Terminal command line. echo " rdr pass inet proto tcp from any to any port 80 -> 127.0.0.1 port 8080 " | sudo pfctl -ef - Taken from https://salferrarello.com/mac-pfctl-port-forwarding/


66

sudo codesign --force --deep --sign - /path/to/application.app I've never had to create a certificate using this method. If that doesn't help, try without --deep and without the trailing slash: sudo codesign --force --sign - /path/to/application.app Note, just to make it clearer: After having applied the signature, start the app, accept incoming ...


60

While RedYeti's link is useful, just to save a few clicks for others let me recap how to generate a code-signing cert and to use it for code (re-)signing: Create your own code signing cert: In Keychain Access, Keychain Access > Certificate Assistant > Create a certificate. This launches the Certificate Assistant: Name: Enter some arbitrary string here ...


41

Yes, as a security measure, macOS Catalina sends some small info (can be seen by packet size) about unsigned executables to the Apple servers. A simple C program as illustrated in .. Does macOS phone home to Apple's servers before running an app for the first time? .. can demonstrate the lag in startup on poor internet connection conditions. https://...


38

netbiosd is responsible for interacting with NetBIOS networks. NetBIOS is Microsoft's networking service. If you block incoming netbiosd connections then you will not be able to share drives over netbios which is the simplest way to share data to Windows machines. If you generally block incoming connections as a precaution the you should block anything ...


36

The modern way to forward ports in El Capitan is using pf. In the example below all port 80 requests are forwarded to port 8080 on the same host. Please adjust the redirections to your needs. Create an anchor file org.user.forwarding in /private/etc/pf.anchors sudo touch /private/etc/pf.anchors/org.user.forwarding with the following content and a ...


24

Little Snitch Research Assistant tells you what it is. akd is part of the AuthKit (authentication/authorisation) framework. Also used in the process of authenticating of iCloud and other accounts using Apple ID.


23

I figured out that I needed to enter the following in the terminal: sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.apsd.plist I did this already, and it seemed to fix the issue, but would love to know if this is the advisable way to solve the problem. ======================================================== Also, in case you want to ...


22

I had the same issue under OS X Yosemite (10.10.3). Found this blog post that provides clear instructions. We can't use ipfw any more, as it's deprecated. Instead, use pfctl, which unfortunately lacks a nice command line way to tell it to open a port. Instead, you need to: Open /etc/pf.conf in a text editor. Add a line like this: # Open port 8080 ...


22

Xcode is likely trying to use the network. This is triggering a rule in your firewall that results in Xcode's code signature being checked – requiring a read of the complete application bundle. Experiment with the following option in OS X's firewall settings: System Preferences.app > Security & Privacy > Firewall > Firewall Options… > Automatically ...


15

This relates to whether the app is signed or not. If it's not signed, the preference won't be remembered. To see if an app is signed do this in Terminal: cd path/to/your/app codesign -vvv Eclipse.app/ For Eclipse - mine says it's not signed at all. I can't comment further on how to sign the app since I've not bothered to do that but this answer on ...


15

You could use the PF firewall: Add this line to /etc/pf.conf to drop all packets to the given ip:port block drop out quick proto tcp to 192.168.1.103 port 80 After changing pf.conf you should reload it with sudo pfctl -f /etc/pf.conf Eventually you will have to enable it with sudo pfctl -e


14

Please see the 2020 and 2021 edits below. The original answer, unchanged: What you are referring to as "the built-in" firewall is actually the built-in Application Firewall. There two other built-in firewalls in OS X Lion, pf and ipfw (the latter is being replaced by pf, but still exist in Mountain Lion). These can handle both incoming and outgoing ...


14

OS X Yosemite doesn’t have support for natd binary or ipfw anymore. Instead pfctl is used. I assume the following IP-adresses/netmasks: Router: 192.168.0.1/24 Mac mini gateway: en0: 192.168.0.2/24 gateway 192.168.0.1 en1: 192.168.1.2/24 Internal network: 192.168.1.0/24 First you have to enable forwarding on your Mac computer with following commands: sudo ...


14

To permanently block outgoing traffic to specific domains and/or ports you should create a new anchor file and add it to pf.conf. Create an anchor file org.user.block.out in /private/etc/pf.anchors sudo touch /private/etc/pf.anchors/org.user.block.out with the following content and a trailing empty line mybadtcphosts = "{ www.domain.com, domain.com, 135....


11

Yes, there are pre-built rule sets, and someone shares them. I just stumbled upon this: Little Snitch rules for blocking ad servers Here they provide a list of pre-built rules for blocking ad-servers. It is not related specifically to iCloud, but in general yes, there are shared sets of rules for Little Snitch. Edit: now I see what Dylan was referring ...


11

Time to answer my own question: Why AirPlayXPCHelper goes out to this network on port 5000 and 7000? This is related to the Peer-to-Peer AirPlay and Airplay device discovery. macOS discovers new device and attempts to connect using these ports to finish (?) discovery process. Couple of my neighbours got new AppleTV and macOS attempts to connect to them....


11

To permanently block outgoing traffic to specific domains you should create a new anchor file and add it to pf.conf. Create an anchor file org.user.block.out in /private/etc/pf.anchors sudo touch /private/etc/pf.anchors/org.user.block.out with the following content and a trailing empty line mybadhosts = "{ www.domain.com, domain.com, www.domain2.com, ...


10

Neither of those ports is opened by the OS. You will want to run a command like sudo lsof|grep LISTEN to figure out what processes have opened those ports on the Mac. See http://support.apple.com/kb/TS1629 for documented ports that Apple uses and note that neither are used other than 10.4 server and earlier where port 8080 was part of jboss as a stock ...


10

There is a thing similar to iptables called pf. Configuration The configuration file is located in the /etc/pf.conf To get started, let’s look at the /etc/pf.conf configuration file that comprises pf: scrub-anchor "com.apple/*" nat-anchor "com.apple/*" rdr-anchor "com.apple/*" dummynet-anchor "com.apple/*" anchor "com.apple/*" ...


9

Here is an improved walkthrough to install fail2ban on OS X 10.10 (it probably works on 10.9 also) based on the (somehow faulty) guide at forgetcomputers.zendisk.com. The automated installer didn't work at all for me so I did it manually. cd to ~/Downloads and download fail2ban-0.8.10 cd ~/Downloads curl -O https://forgetcomputers.zendesk.com/hc/en-us/...


8

The issue is that the firewall option stops connections from outside to the app but for an update the app initiates the contact to the suppliers server so the firewall does not help here. the program Little Snitch does allow you to control the app starting a conversation with another IP address and so can do what you want.


7

IMAgent is a process that listens for FaceTime invitations. It will be active even if FaceTime isn't running. You don't have to block it, but if you don't use FaceTime you can open the application, open preferences, and turn off FaceTime. That should quit the IMAgent process.


7

Apple's OS X Mavericks contains three firewalls. First of all, the Application Level Firewall which can be configured using the system settings. But there is also ipfw, a packet filtering firewall like netfilter/iptables on GNU/Linux and pf (FreeBSD/OpenBSD). You can either configure ipfw using the command line, or using a graphical front-end like the free/...


7

The proper rule is: block in quick inet proto { tcp, udp } from any to any port 63342 Some parts may be omitted (e.g. inet or from any) with a slightly different meaning.


7

By default, your Tor client only listens for applications that connect from localhost (i.e. lo0 - 127.0.0.1). So the proxy is not bound to other interfaces like en0 or en1. To set up a Tor proxy for apps on other hosts in the network you should follow the how-to: I want to run my Tor client on a different computer than my applications. By default, your ...


7

Finally, I found a solution by using PF. (1) edit PF configuration sudo vim /etc/pf.conf Append the following line to the file: block drop from any to <IP Address> For example: block drop from any to 8.8.8.8 (2) Load the config by running sudo pfctl -f /etc/pf.conf (3) Enable PF by running: sudo pfctl -e (*) If you want to disable PF, run: ...


6

ipfw is deprecated by Apple. Mountain Lion and later use pfctl. http://support.apple.com/kb/ht5413


Only top voted, non community-wiki answers of a minimum length are eligible