1

I've setup port-forwarding on my mac like this:

sudo sysctl net.inet.ip.forwarding=1
echo "rdr pass inet proto tcp from any to any port 445 -> 127.0.0.1 port 5441" | sudo pfctl -ef -

To this setup, I am running a server using nc like this:

$ nc -l 5441

When I try to connect to this server via telnet, the attempt fails with the following error:

$ sudo telnet 127.0.0.1 445
Trying 127.0.0.1...
telnet: connect to address 127.0.0.1: Connection refused
telnet: Unable to connect to remote host

Running tcpdump on port 445 doesn't capture any packets. I am not sure what's going on and would appreciate all the help.

2

A rdr is only a redirect; one also may need a pass (or appropriate clicky around in the System Preferences) to permit access to that port. This works for me (though I've almost totally disabled the Apple firewall rules on my Mac OS X 10.11 laptop) in /etc/pf.conf:

set skip on { lo0, vboxnet0 }
rdr pass inet proto tcp from any to any port 445 -> 127.0.0.1 port 5441
block in
pass in inet proto tcp from any to any port 445

And then a sudo pfctl -f /etc/pf.conf to load that and then testing with nc -l 127.0.0.1 5441 and connections to port 445 from a remote machine shows access.

Hmm! However, locally to the Mac OS X system telnet 127.0.0.1 445 fails, probably on account of the skip lo0. This can be rectified by not using skip if localhost access to the redirect is necessary:

set skip on vboxnet0
rdr pass inet proto tcp from any to any port 445 -> 127.0.0.1 port 5441
block in
pass on lo0
pass in inet proto tcp from any to any port 445

Also note that locahost may either mean 127.0.0.1 or ::1 so you may also need to setup inet6 related rules, or ensure that the connections are always done with IPv4 so that IPv6 either works or is not used.

  • Thanks @thrig, this works. Few questions though. Do I need to disable all filtering on vboxnet0 (set skip on vboxnet0)? And why do I need to 'block in'? – user1071840 Feb 16 '17 at 17:45
  • vboxnet0 is for virtualbox, which you may or may not have or may or may not need. block in blocks by default; not much of a firewall without that. I guess you could pass everything in... (also the Apple rules might complicate matter but again I've disabled those include) – thrig Feb 16 '17 at 17:57
  • Got it, May I complicate this a bit now? I am running nc based server on mac. I can telnet on port 445 from my mac, but I can't telnet on the same port from my windows 2012 virtual machine (virtualbox). Although, I can ping host mac from guest windows. Any idea why would that be? – user1071840 Feb 16 '17 at 18:28
  • Virtualbox will really depend on how you set up the networking and how virtualbox interacts with Apple's implementation of pf. That's why I have a vboxnet0 that both the mac and any virts I want all live on, so they can communicate without the fuss of NAT. – thrig Feb 16 '17 at 18:53
  • What does "pass on lo0" mean here? And why do we specify a redirect rule before blocking in everything? – user1071840 May 1 '17 at 18:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.