Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.
$sudo /usr/libexec/ApplicationFirewall/socketfilterfw --listapps
ALF: total number of apps = 2 

1 :  /Applications/some.app 
 ( Allow incoming connections ) 

2 :  /Applications/another.app 
 ( Block incoming connections ) 

The above command shows that another.app is a part of my firewall trusted apps list, but it is set to block incoming connections. How can I set it to allow incoming connections from the command line, and make the change effective immediately?

share|improve this question
    
I discovered that I can do the following to unblock apps sudo /usr/libexec/ApplicationFirewall/socketfilterfw --unblockapp /path/to/app. However, when I do the above for /opt/local/apache2/httpd, and it shows as being unblocked, I still can't reach the web server. Any suggestions? –  punkish Sep 17 '11 at 17:24

2 Answers 2

I have had same problem and "solved" the problem by unloading / loading MacPorts httpd with the Mac OS X 10.8 application firewall (socketfilterfw) running. Have no idea why this worked. One clue is as soon as I ran the load a prompt popped up asking whether to allow connections. This despite having already entered the MacPorts httpd application in the filewall options GUI.

  1. System Preferences > Security & Privacy > Firewall: Turn firewall on if it is off
  2. sudo port unload apache2
  3. sudo port load apache2

Before fix:
Aug 27 22:42:59 mac1 socketfilterfw : Deny _ connecting from mac2 to port _ proto=6
During fix:
Aug 27 22:44:05 mac1 socketfilterfw : httpd is listening from :::_ proto=6
After fix:
Aug 27 22:45:32 mac1 socketfilterfw : Allow _ connecting from mac2 to port _ proto=6

I searched for "httpd is listening" and in the past several days this is the only occurrence in the appfilewall log.

Hope this helps someone. I don't know why it worked for me but I have used it twice ... today and about six weeks ago. System reboots ever week.

share|improve this answer

You can get more info about socketfilterfw by running it with -h:

# /usr/libexec/ApplicationFirewall/socketfilterfw -h
usage: /usr/libexec/ApplicationFirewall/socketfilterfw [-c] [-w] [-d] [-l] [-T] [-U] [-B] [-L] [-a listen or accept] [-s file to sign] [-v file to verify] [-p pid to write] [--getglobalstate] [--setglobalstate on | off] [--getblockall] [--setblockall on | off] [--listapps] [--getappblocked <path>] [--blockapp <path>] [--unblockapp <path>] [--add <path>] [--remove <path>] [--getallowsigned] [--setallowsigned] [--getstealthmode] [--setstealthmode on | off] [--getloggingmode] [--setloggingmode on | off] 
...
 --unblockapp <path>           unblock the application at <path>

So in your case you can do:

# /usr/libexec/ApplicationFirewall/socketfilterfw --unblockapp /Applications/another.app

If you still can't hit it make sure to check ipfw:

# ipfw -a l
65535 0 0 allow ip from any to any

If you have other rules in there you can:

# ipfw flush

To remove them.

If none of that works try disabling them both and seeing if you are still unable to connect:

# sysctl -w net.inet.ip.fw.enable=0
#  /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate off
Firewall already disabled

If you are still having problems then theres probably a config issue with apache.

share|improve this answer
    
hmmmm... I did mention the above strategy in my comment above a couple of hours ago, but I also mentioned that in spite of being able to "--unblock" the app, it still remains blocked. I am not using ipfw (yet), and am sure I have not inadvertently turned it on. This is a brand new Lion machine. –  punkish Sep 17 '11 at 20:12
    
Sorry about that, I had written the answer out then forgot to hit post. I added some ipfw and disable stuff, let me know if disabling it doesn't fix the problem. –  polynomial Sep 17 '11 at 20:16
    
I have never tinkered with ipfw on this machine, and ipfw -a l does return 65535 0 0 allow ip from any to any. I only set up the firewall via Sys Prefs, and inadvertently set /opt/local/apache2/bin/httpd to block incoming connections. Now I am not in front of my machine, but logged in remotely. I can use socketfilterfw --unblockapp /opt/local/apache2/bin/httpd and it lists the app as being unblocked 3 : /opt/local/apache2/bin/httpd ( Allow incoming connections ) yet apache2 doesn't respond to requests. However, if I turn socketfilterfw --setglobalstate off then it works fine. –  punkish Sep 17 '11 at 20:24
    
Did you install a new apache? Are you sure its the one thats running? On my OS X Lion laptop(pretty much stock) its actually /usr/sbin/httpd that I need to allow for it to work. –  polynomial Sep 17 '11 at 20:26
    
yes, this is apache2 installed via macports under /opt/local/apache2/ –  punkish Sep 17 '11 at 20:36

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.