Firewall problems in Leopard

[mtechoh]

This problem started with a new Xserve, fresh install of Leopard server and everything up to date. The server is not acting as the firewall or gateway for the LAN. The only goal is to allow VPN through it. Everything else goes through another firewall.

The problem is that when the firewall is enabled on the server, it takes several minutes for anyone to connect to a share on the LAN. When a user tries to connect they get a “Looking for servername.local” that eventually times out and then connects and works as expected. This happens even if all rules to the server’s firewall are flushed. Just the act of having it turned on causes this problem. That delay doesn’t affect any VPN user.

If I turn it off then there is no delay and everything works perfectly — except I don’t have a firewall to block the outside world.

I had this posted on Apple’s site for a while, but only got other people having the same problem and no answers. Anyone have any ideas?

Thanks.

[mtechoh]

Initially for the firewall I used the default to allow everything on internal and only DNS and VPN on external NIC. When that failed I tried removing ALL rules and flushed it to make sure it was clear. Same problem. Just turning the firewall on causes the problem.

[gcraiga]

I’m currently setting up a Mac OX X 10.5.5 server and I’m running into the same problem. Did you or anyone ever find a resolution for this?

mDNS (Bonjour) lookups take about 60-90 seconds to resolve when the server’s firewall is running. This is the same problem across lookups for any service (SSH via terminal, web, AFP). I don’t plan to use mDNS on our network as the server will be running DNS for our LAN, but Time Machine backups always connect to the AFP share using the mDNS name rather than the server’s Fully Qualified Domain Name. I know the service is being “advertised” via mDNS because the time machine share shows up on the network, but unfortunately when this lookup takes such a long time it will more or less freeze the client system as it resolves.

Client machines aren’t running firewalls locally.
This happens with both tiger and leopard clients.
I have tried setting the firewall to allow all connections from “any” to “any” but it still doesn’t work.
I am not running DNS on the server but I have tried turning it on with still no luck.
I’ve tried to reinstall and set up the server to no avail.

Here are the results from running “sudo ipfw list”:

01000 allow ip from any to any via lo0
01010 deny ip from any to 127.0.0.0/8
01020 deny ip from 224.0.0.0/4 to any in
01030 deny tcp from any to 224.0.0.0/4 in
12300 allow tcp from any to any established
12301 allow tcp from any to any out
12302 allow tcp from any to any dst-port 22
12302 allow udp from any to any dst-port 22
12303 allow udp from any to any out keep-state
12304 allow tcp from any to any dst-port 53 out keep-state
12304 allow udp from any to any dst-port 53 out keep-state
12305 allow udp from any to any in frag
12306 allow tcp from any to any dst-port 311
12307 allow tcp from any to any dst-port 625
12308 allow udp from any to any dst-port 626
12309 allow icmp from any to any icmptypes 8
12310 allow icmp from any to any icmptypes 0
12311 allow igmp from any to any
12312 allow ip from 192.168.15.0/24 to any via en0 keep-state
12312 allow ip from 192.168.16.0/24 to any via en0 keep-state
12313 allow udp from any 68 to any dst-port 67 via en0
65534 deny ip from any to any
65535 allow ip from any to any

Note that this should block most services but allow machines on our internal subnets (192.168.15.0 and 192.168.16.0) to connect at any open port.

Any help or advice will be greatly appreciated.

[mtechoh]

I didn’t find a solution other than use a separate firewall. Not a good solution, but can’t have a client down. I have another client with the same server setup and everything works for Leopard clients, but the long delay for Tiger clients.

[Author]

Posts