OS X blocks calls to local services

Question

Accessing local services such as the web-based CUPS configuration (port 631) or Apache Tomcat (port 8080) with anything other than http://localhost:<port> fails. HOWEVER, doing the same with Apache httpd that came shipped with OS X works just fine. What's going on here?

http://192.168.1.5:631/ - fails

http://localhost:631/ - works

http://192.168.1.5:8080/ - fails

http://localhost:8080/ - works

http://192.168.1.5:80/ - works!!!

http://localhost:80/ - works

I understand that 'localhost' uses the loop-back network interface while 192.168.1.5 doesn't. So, in theory it's possible for the OS X firewall to interfere. However, the logs don't show dropped requests. Also, the behavior is exactly the same with the firewall turned off.

Answer 1

Yes, I wasn't aware that a port isn't necessarily bound to any address or any interface but to a specific address.

CUPS

The CUPS config specifically binds to localhost by default. See config at /private/etc/cups/cupsd.conf:

# Only listen for connections from the local machine.
Listen localhost:631
Listen /private/var/run/cupsd 

If you enable printer sharing in Preferences -> Sharing CUPS will be available outside localhost, too.

Tomcat

I don't know yet which setting makes Tomcat bind to localhost only. However, for now I set up mod_jk to put Tomcat behind Apache.

Answer 2

A listening port can be bound to a specific interface address, or to any address.

Try the command: netstat -anp TCP

(It may be slightly different -- I'm not in front of a Mac right now. You want to display all listening TCP ports and their numerical addresses. )

You should see something like:

TCP 0.0.0.0:80 ...

TCP 127.0.0.1:631 ...

A port number preceded by 0.0.0.0 means that it will accept a connection from anywhere. If preceded by 127.0.0.1, it means it will only accept a connection from the loopback interface.