Mac – Open Port 443 on the MacMini without using the Server App

firewallhigh sierramac-miniNetworkosx-server

I'm using an AT&T router where I have port 443 open. I did a port scan and it does not show 443 open. I have the firewall open with all the default options listed that Allow incoming connections.

I'm using Let's Encrypt on my development MacMini server for my SSL certificates. I'm having a problem with accessing my website. I contacted the Let's Encrypt forum and was told that my problem was that port 443 was blocked.

This is the only option that I found so far that claims to force open a port. This solution is three years old. I'm not familiar with netcat so I'm reluctant to use it without more understanding on how this works?

How to force open TCP 443 on my machine?

I've also read several solutions that use the Server app. I'm not using the Server app because I had problems with it a while ago. Is there another clean option to turn this port on that does not use it? I'll install it if I need to but I prefer another option if one is available.

UPDATE 03/13/2019: I just installed the latest version of macOS Server to try and open port 443. The vast majority of features that were available in older versions of the Server app have been removed so I need to find another option to get this done.

Best Answer

"443... connected. Unable to establish SSL connection" means that the problem isn't related to port 443 being blocked; your version of wget is probably stale (see this StackOverflow post.)

Try curl instead: curl https://mydomain.com

(Note: the "https://" part is important!)

Related Solutions

How to open a port (not application) in the OS X 10.6 firewall

Worked for me.

I wanted to open traffic on port 70, so I entered the following:

sudo ipfw add 7000 allow tcp from any to any dst-port 70

The response from the command-prompt was:

07000 allow tcp from any to any dst-port 70

Yes, the 0 was automatically added to the rule #, so it is worth noting that any rule ID < 10,000 will be prefixed by one or more zeroes.

How does one lock down OS X Server using the PF firewall

You should:

understand pf basics - here is many guides on the Internet, you can safely read any Open/Free BSD guide. You must understand a few basic things:
- with PF, last rule wins (opposite of IPFW's "first rule wins")
- logging is in the pflog device if the 'tcpdump' format
- check the pfctl command using man pfctl
- also check man pf.conf
- you can create many simple text files that contains IP addresses (called tables) and using them in the filtering rules - see the example below.
AFTER this you can use two GUI frontends
- IceFloor (instead of the WaterRoof)
- Firewall builder (cross platform)

PF is not too hard if you have some knowledge about how firewalling works in general.

Fragment of pf.conf for table based filtering:

interface = "en0"
allowed_ports = "{ 80, 443 }"
table <badips> persist
table <noroute> const { 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8 }
block in on $interface from { <noroute>, <badips> } to any
pass in on $interface inet proto tcp from <badips> to $interface port $allowed_ports

The above example contains:

some basic definitions, like your interface name and some ports
definition for two tables, noroute for nonroutable addresses (RFC 1918) and the second badips that can contain your Geo IP based IP addresses
filtering rule - blocking anything from these tables
allowing ports 80 and 443 from badips (last rule wins)

Related Question