1

The problem: I have a local Apache instance on my Macbook Pro. I need it to listen on all network interfaces except en0 and en1 (basically, listen on lo and vnicX from Parallels).

I know about "Listen *:80" but this is not a solution in this particular case. The only thing I could imagine if to use OS X firewall to block incoming requests to Apache on those interfaces. But I could not find any working examples and could not make such rules myself.

Could somebody help, please?

3 Answers 3

1

Apache can be configured to listen either on all addresses (Listen *:80), or on particular addresses (Listen 192.168.23.42:80). It can't be configured to not listen on particular addresses (or interfaces for that matter). If you want that, you have use a firewall to block connections on those interfaces. Something like this might do the trick:

ipfw add deny any to dst-port 80 in via en0
ipfw add deny any to dst-port 80 in via en1
3
  • As I wrote in the question, I am looking for firewall rules...
    – User366
    Sep 11, 2012 at 8:49
  • Updated answer. Sep 11, 2012 at 18:20
  • 1
    Just note Mac OSX lion and above use pf not ipfw
    – topdog
    Sep 11, 2012 at 18:32
1

I'd go with using the Firewall settings instead. They're in Settings -> Security & Privacy -> Firewall.

1
  • It does not let to block certain interfaces. It is all or nothing.
    – User366
    Sep 11, 2012 at 8:50
1

After reading the OS X security guide, I used ipfw. It works ok in Mountain Lion. Here is what I did:

Create a file named /etc/ipfw.conf with the following content:

 add 1000 deny tcp from any to any dst-port 80 via en0
 add 2000 deny tcp from any to any dst-port 80 via en1

You may want to go for slightly different set of rules (like block all but allow "lo0" interface) if you use a USB modem.

Create a file named /Library/LaunchDaemons/ipfw.plist with the following content:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://
     www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key>
    <string>ipfw</string>
  <key>Program</key>
    <string>/sbin/ipfw</string>
  <key>ProgramArguments</key>
    <array>
      <string>/sbin/ipfw</string>
      <string>/etc/ipfw.conf</string>
    </array>
  <key>RunAtLoad</key>
    <true />
</dict>
</plist>

Register with launchd:

 launchctl load -w /Library/LaunchDaemons/ipfw.plist

Check that rules are registered:

ipfw print

You should get:

01000 deny tcp from any to any dst-port 80 via en0
02000 deny tcp from any to any dst-port 80 via en1
65535 allow ip from any to any

The last rule is needed!

Now you can try to connect from another computer to your own and check that connection is blocked. Note that you are always able to connect from your own computer to your own computer. Try your smartphone or friend's computer.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .