4 
$sudo /usr/libexec/ApplicationFirewall/socketfilterfw --listapps
ALF: total number of apps = 2 

1 :  /Applications/some.app 
 ( Allow incoming connections ) 

2 :  /Applications/another.app 
 ( Block incoming connections )

The above command shows that another.app is a part of my firewall trusted apps list, but it is set to block incoming connections. How can I set it to allow incoming connections from the command line, and make the change effective immediately?

Improve this question
1
  • I discovered that I can do the following to unblock apps sudo /usr/libexec/ApplicationFirewall/socketfilterfw --unblockapp /path/to/app. However, when I do the above for /opt/local/apache2/httpd, and it shows as being unblocked, I still can't reach the web server. Any suggestions?
    – punkish
    Sep 17, 2011 at 17:24

2 Answers 2

Reset to default
3

I have had same problem and "solved" the problem by unloading / loading MacPorts httpd with the Mac OS X 10.8 application firewall (socketfilterfw) running. Have no idea why this worked. One clue is as soon as I ran the load a prompt popped up asking whether to allow connections. This despite having already entered the MacPorts httpd application in the filewall options GUI.

  1. System Preferences > Security & Privacy > Firewall: Turn firewall on if it is off
  2. sudo port unload apache2
  3. sudo port load apache2

Before fix:
Aug 27 22:42:59 mac1 socketfilterfw : Deny _ connecting from mac2 to port _ proto=6
During fix:
Aug 27 22:44:05 mac1 socketfilterfw : httpd is listening from :::_ proto=6
After fix:
Aug 27 22:45:32 mac1 socketfilterfw : Allow _ connecting from mac2 to port _ proto=6

I searched for "httpd is listening" and in the past several days this is the only occurrence in the appfilewall log.

Hope this helps someone. I don't know why it worked for me but I have used it twice ... today and about six weeks ago. System reboots ever week.

Improve this answer
2

You can get more info about socketfilterfw by running it with -h:

# /usr/libexec/ApplicationFirewall/socketfilterfw -h
usage: /usr/libexec/ApplicationFirewall/socketfilterfw [-c] [-w] [-d] [-l] [-T] [-U] [-B] [-L] [-a listen or accept] [-s file to sign] [-v file to verify] [-p pid to write] [--getglobalstate] [--setglobalstate on | off] [--getblockall] [--setblockall on | off] [--listapps] [--getappblocked <path>] [--blockapp <path>] [--unblockapp <path>] [--add <path>] [--remove <path>] [--getallowsigned] [--setallowsigned] [--getstealthmode] [--setstealthmode on | off] [--getloggingmode] [--setloggingmode on | off] 
...
 --unblockapp <path>           unblock the application at <path>

So in your case you can do:

# /usr/libexec/ApplicationFirewall/socketfilterfw --unblockapp /Applications/another.app

If you still can't hit it make sure to check ipfw:

# ipfw -a l
65535 0 0 allow ip from any to any

If you have other rules in there you can:

# ipfw flush

To remove them.

If none of that works try disabling them both and seeing if you are still unable to connect:

# sysctl -w net.inet.ip.fw.enable=0
#  /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate off
Firewall already disabled

If you are still having problems then theres probably a config issue with apache.

Improve this answer
6
  • hmmmm... I did mention the above strategy in my comment above a couple of hours ago, but I also mentioned that in spite of being able to "--unblock" the app, it still remains blocked. I am not using ipfw (yet), and am sure I have not inadvertently turned it on. This is a brand new Lion machine.
    – punkish
    Sep 17, 2011 at 20:12
  • Sorry about that, I had written the answer out then forgot to hit post. I added some ipfw and disable stuff, let me know if disabling it doesn't fix the problem.
    – polynomial
    Sep 17, 2011 at 20:16
  • I have never tinkered with ipfw on this machine, and ipfw -a l does return 65535 0 0 allow ip from any to any. I only set up the firewall via Sys Prefs, and inadvertently set /opt/local/apache2/bin/httpd to block incoming connections. Now I am not in front of my machine, but logged in remotely. I can use socketfilterfw --unblockapp /opt/local/apache2/bin/httpd and it lists the app as being unblocked 3 : /opt/local/apache2/bin/httpd ( Allow incoming connections ) yet apache2 doesn't respond to requests. However, if I turn socketfilterfw --setglobalstate off then it works fine.
    – punkish
    Sep 17, 2011 at 20:24
  • Did you install a new apache? Are you sure its the one thats running? On my OS X Lion laptop(pretty much stock) its actually /usr/sbin/httpd that I need to allow for it to work.
    – polynomial
    Sep 17, 2011 at 20:26
  • yes, this is apache2 installed via macports under /opt/local/apache2/
    – punkish
    Sep 17, 2011 at 20:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .