Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

The problem: I have a local Apache instance on my Macbook Pro. I need it to listen on all network interfaces except en0 and en1 (basically, listen on lo and vnicX from Parallels).

I know about "Listen *:80" but this is not a solution in this particular case. The only thing I could imagine if to use OS X firewall to block incoming requests to Apache on those interfaces. But I could not find any working examples and could not make such rules myself.

Could somebody help, please?

share|improve this question

3 Answers 3

up vote 1 down vote accepted

Apache can be configured to listen either on all addresses (Listen *:80), or on particular addresses (Listen It can't be configured to not listen on particular addresses (or interfaces for that matter). If you want that, you have use a firewall to block connections on those interfaces. Something like this might do the trick:

ipfw add deny any to dst-port 80 in via en0
ipfw add deny any to dst-port 80 in via en1
share|improve this answer
As I wrote in the question, I am looking for firewall rules... –  Dmitry Dulepov Sep 11 '12 at 8:49
Updated answer. –  Ansgar Wiechers Sep 11 '12 at 18:20
Just note Mac OSX lion and above use pf not ipfw –  topdog Sep 11 '12 at 18:32
It works great in Mountain Lion. Thanks, Ansgar! –  Dmitry Dulepov Sep 19 '12 at 9:41

After reading the OS X security guide, I used ipfw. It works ok in Mountain Lion. Here is what I did:

Create a file named /etc/ipfw.conf with the following content:

 add 1000 deny tcp from any to any dst-port 80 via en0
 add 2000 deny tcp from any to any dst-port 80 via en1

You may want to go for slightly different set of rules (like block all but allow "lo0" interface) if you use a USB modem.

Create a file named /Library/LaunchDaemons/ipfw.plist with the following content:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://
<plist version="1.0">
    <true />

Register with launchd:

 launchctl load -w /Library/LaunchDaemons/ipfw.plist

Check that rules are registered:

ipfw print

You should get:

01000 deny tcp from any to any dst-port 80 via en0
02000 deny tcp from any to any dst-port 80 via en1
65535 allow ip from any to any

The last rule is needed!

Now you can try to connect from another computer to your own and check that connection is blocked. Note that you are always able to connect from your own computer to your own computer. Try your smartphone or friend's computer.

share|improve this answer

I'd go with using the Firewall settings instead. They're in Settings -> Security & Privacy -> Firewall.

share|improve this answer
It does not let to block certain interfaces. It is all or nothing. –  Dmitry Dulepov Sep 11 '12 at 8:50

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.