I've got netatalk running as an AFP server so I can make Time Machine backups on my LAN. It works perfectly as long as iptables accepts all incoming traffic on the LAN, but I'm trying to tighten up security on the server, so I set the default iptables input policy to REJECT, and now I need to open up the ports needed for Time Machine. I'm using [ferm][1] to configure iptables.

I added the following rule in ferm.conf:

proto tcp saddr $LAN_SUBNET dport afpovertcp ACCEPT;

which generates this iptable rule:

-A INPUT --protocol tcp --source --dport afpovertcp --jump ACCEPT

but the Time Machine server still isn't showing up when I browse Network in Finder.

What other ports need to be open to traffic on the LAN?

1 Answer 1


I opened these ports, and Time Machine backups are now working:

afpovertcp mdns svrloc at-rtmp at-nbp at-echo at-zis 1900

To generate the iptables rules I added the following to ferm.conf:

# netatalk daemon ports for AFP Time Machine server
@def $PORT_TIME_MACHINE = (afpovertcp mdns svrloc at-rtmp at-nbp at-echo at-zis 1900);

# allow AFP connentions on for Time Machine on LAN
proto (udp tcp) saddr $LAN_SUBNET dport $PORT_TIME_MACHINE ACCEPT;

New iptables rules:

-A INPUT --protocol udp --source --dport afpovertcp --jump ACCEPT
-A INPUT --protocol udp --source --dport mdns --jump ACCEPT
-A INPUT --protocol udp --source --dport svrloc --jump ACCEPT
-A INPUT --protocol udp --source --dport at-rtmp --jump ACCEPT
-A INPUT --protocol udp --source --dport at-nbp --jump ACCEPT
-A INPUT --protocol udp --source --dport at-echo --jump ACCEPT
-A INPUT --protocol udp --source --dport at-zis --jump ACCEPT
-A INPUT --protocol udp --source --dport 1900 --jump ACCEPT
-A INPUT --protocol tcp --source --dport afpovertcp --jump ACCEPT
-A INPUT --protocol tcp --source --dport mdns --jump ACCEPT
-A INPUT --protocol tcp --source --dport svrloc --jump ACCEPT
-A INPUT --protocol tcp --source --dport at-rtmp --jump ACCEPT
-A INPUT --protocol tcp --source --dport at-nbp --jump ACCEPT
-A INPUT --protocol tcp --source --dport at-echo --jump ACCEPT
-A INPUT --protocol tcp --source --dport at-zis --jump ACCEPT
-A INPUT --protocol tcp --source --dport 1900 --jump ACCEPT

These resources were helpful: Netatalk article on Arch wiki; TCP and UDP ports used by Apple software products

  • 1
    Note, if you want to you may be able to merge all the ports together in one rule for udp and one for tcp using -m multiport --dports afpovertcp,mdns,....
    – meuh
    Apr 10, 2017 at 8:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .