Rather confused by the results I'm getting on a Mac OS X Server running 10.8. I have an app that is running a web server on port 8000, which I want to be visible only to localhost. This seems perfectly suited for the GUI OS X firewall, but after turning it on (and searching its limited options), I'm still able to connect to port 8000 from remote computers.
After turning the firewall on, I automatically have ports open for AFP, SSH, Remote Management, and Screen Sharing, none of which should affect 8000 AFAIK. What am I missing here? And is this a job for the built-in firewall, or should I be looking at pf or ipfw?