I'd like to locally test my web application's behavior under different firewall circumstances.

We have an application that makes requests from the browser to different ports depending upon certain conditions, and I'd like to set up a firewall that allows me to modify firewall rules dynamically so as to see how the application behaves when a port is disabled.

I'd like to do this by setting up a firewall that blocks requests from my machine to a port on a guest machine.

I'm running OS X Sierra with Virtualbox, using pfctl.

I started with this command (on the host), attempting to block ports on the guest (at, but I haven't had any success:

block in quick inet proto { tcp, udp } from any to port 63342
  • 1
    Block it on the host machine?
    – ivanivan
    Aug 3, 2018 at 1:28

1 Answer 1


This seems a little counter intuitive to me in how you're approaching it. Typically you'd setup the firewall on the actual server where the web application is residing.

If you're using firewalld this is pretty trivial. You can see the names of all the services it's able to deal with by name using this command:

$ firewall-cmd --get-services
web names
$ firewall-cmd --get-services | grep -oE '\shttp[s]*'

To allow these two protocols into the VM:

$ firewall-cmd --permanent --add-service http --add-service https

$ firewall-cmd --reload

Your firewall is now configured like so:

$ firewall-cmd --list-all
public (active)
  target: DROP
  icmp-block-inversion: no
  interfaces: eth0 eth1
  services: ssh dhcpv6-client http https
  masquerade: no
  rich rules:

The above states that 4 services are allowed in, everything else will get dropped (DROP) based on the default target.


  • "This seems a little counter intuitive to me in how you're approaching it." I've updated the question to clarify what I'm doing. Thanks!
    – Brian Dant
    Aug 3, 2018 at 13:38
  • @BrianDant - thanks for updating. I still do not understand why you cannot merely do the firewall within the VM? Doing it in the VM or on the laptop is merely a semantics, and is easier to accomplish within the VM IMO.
    – slm
    Aug 3, 2018 at 16:15
  • 1
    Yes, I should have included a note about that, too. I'm using boot2docker as a VM, which, according to stackoverflow.com/a/36576817/785400, I should heed this "word of warning": "you shouldn't treat the docker-machine VM as a regular VM where you install tons of packages and customize. It's only meant to run containers. It's best to keep it that way." So I veered away from this. But your point is valid otherwise, as far as I can see. Thanks again!
    – Brian Dant
    Aug 3, 2018 at 17:45

Not the answer you're looking for? Browse other questions tagged .