Re: How can I make unbound's accepting of incoming network connections in application firewall in Catalina 'stick'?

[Steven Smith]

Just turn off your firewall! 😝

Seriously, the macOS firewall is an Application firewall. If that suits your 
risk profile, you can control it through the command line:

/usr/libexec/ApplicationFirewall/socketfilterfw -h

Port- and packet-based filtering is handled by pfctl, and that’s a lot more 
flexible than the macOS application firewall.

> On Mar 14, 2021, at 20:55, Gerben Wierda via macports-users 
> <macports-users@lists.macports.org> wrote:
> I am running an extensive MacPorts (with postfix, dovecot, nginx, minion, 
> etc.) on my macOS Server, which is still running macOS Mojave.
> 
> On one of the other Macs, running macOS Catalina, I run a backup unbound 
> caching nameserver. This also offers me a way to do some minimal testing of 
> the MacPorts setup on a more recent version of macOS (as a preparation for 
> upgrading the Mojave system when Apple stops supporting it)
> 
> The unbound on macOS Catalina runs fine, except for one thing. After a 
> reboot, unbound will not accept incoming connections until I have logged in 
> an answer the application firewalls’ question:
> 
> Do you want the application “unbound” to accept incoming network connections?
> Clicking Deny may limit the application’s behaviour. This setting can be 
> changed in the Firewall pane of Security & Privacy preferences.
> 
> I can answer yes, check the entry in the application firewall (set to yes, 
> accept, even before I allow it through the panel). But even if it is set to 
> accept incoming connections, after a reboot I need to log in and answer again 
> via the GUI before it accepts. Setting this in the Application firewall 
> doesn’t ’stick’ for some reason.
> 
> This is not acceptable behaviour if I ever upgrade my Mojave Server, as that 
> one must be able to do unsupervised reboots/running without any login.
> 
> Is there something special in Catalina I must do? Or is this expected 
> behaviour?
> 
> Thanks,
> 
> Gerben Wierda (LinkedIn)
> R&A Enterprise Architecture (main site)
> Book: Chess and the Art of Enterprise Architecture
> Book: Mastering ArchiMate

smime.p7s
Description: S/MIME cryptographic signature