bind afpovertcp to LAN interface only?

hey all-

here’s one that’s been vexing me for a while now. i use my OSX box as a router/firewall, and have a PCI NIC running my internal LAN, while the built-in interface connects out to the world. The only problem is that I want to bind Apple File Sharing to the local interface only, so that port 548 is not open to the world. however, this is a highly undocumented service, and /etc/afpovertcp.cfg doesn’t have any hints as to the correct syntax (even if that file is even the place to take care of such a change). obviously, nothing in Netinfo Manager jumps out at me.

I’d be happy to take care of this with the firewall, but the frustrating thing is that even though I’m specifically closing down the port in ipfw, it’s being overridden.

Any ideas here?

Maybe figuring this out will help me to figure out how to close down port 427 (svrloc) as well, and then i’ll be (reasonably) secure!

Thanks in advance for any and all help.

Darren David