On OS X mavericks (10.9), port forwarding is not enabled in the system firewall, preventing the .dev domain resolution from working

[paradox460]

Issue #415 mentions this, and has the fix of manually running sudo sysctl net.inet.ip.fw.enable=1 which solves the problem, but only until the machine is rebooted.

Interestingly enough, Pow's cx.pow.firewall.plist launchd daemon runs this command:

sh -c "ipfw add fwd 127.0.0.1,20559 tcp from any to me dst-port 80 in && sysctl -w net.inet.ip.forwarding=1"

Unfortunately, launchd doesn't like this, because it doesn't know what sh is.

Changing sh to the absoute path of /bin/sh fixes this

[joachimVdH]

I changed cx.pow.firewall , to :

/bin/sh -c "ipfw add fwd 127.0.0.1,20559 tcp from any to me dst-port 80 in && sysctl -w net.inet.ip.forwarding=1"

restarted, but pow is still not working for me.

I had to manually open terminal and :
sudo sysctl -w net.inet.ip.fw.enable=1

to get pow working

Am I missing something here to test it properly ?

[paradox460]

Hmm. It seems to work on my machine. Are you sure the launchd file is loaded and has no errors?

This is my cx.pow.firewall.plist

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>
    <string>cx.pow.firewall</string>
    <key>ProgramArguments</key>
    <array>
        <string>/bin/sh</string>
        <string>-c</string>
        <string>ipfw add fwd 127.0.0.1,20559 tcp from any to me dst-port 80 in && sysctl -w net.inet.ip.forwarding=1</string>
    </array>
    <key>RunAtLoad</key>
    <true/>
    <key>UserName</key>
    <string>root</string>
</dict>
</plist>

[joachimVdH]

Hi after a fresh reboot, it ain't working.
my cx.pow.firewall.plist

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>
    <string>cx.pow.firewall</string>
    <key>ProgramArguments</key>
    <array>
        <string>/bin/sh</string>
        <string>-c</string>
        <string>ipfw add fwd 127.0.0.1,20559 tcp from any to me dst-port 80 in &amp;&amp; sysctl -w net.inet.ip.forwarding=1</string>
    </array>
    <key>RunAtLoad</key>
    <true/>
    <key>UserName</key>
    <string>root</string>
</dict>
</plist>

on first sight it is the same.
after manual launching :

$ launchctl unload /Library/LaunchDaemons/cx.pow.firewall.plist
$ launchctl load /Library/LaunchDaemons/cx.pow.firewall.plist

still no success.

[paradox460]

Does it say &?

Because it's not supposed to. That was probably chrome on my end messing up the xml paste.

Also, I can attest to it working, even after three reboots. Perhaps it's the && in there is what's causing problems. You might want to check your system log files

[joachimVdH]

It was & , so i changed it to && , but then I could not load the file :

$ launchctl load /Library/LaunchDaemons/cx.pow.firewall.plist
launchctl: no plist was returned for: /Library/LaunchDaemons/cx.pow.firewall.plist
launchctl: no plist was returned for: /Library/LaunchDaemons/cx.pow.firewall.plist
nothing found to load

Then I looked it up, and it seems that that it has to be & :
http://apple.stackexchange.com/questions/8166/running-a-command-whenever-mac-boots-up-with-launchctl-plist

so I changed it to & again, it loads, but doesn't work.

[paradox460]

@joachimVdH In the last commit, I changed it to not attempt to run sysctl twice, but rather once, and have it set two properties

The raw command would be /bin/sh -c "ipfw add fwd 127.0.0.1,20559 tcp from any to me dst-port 80 in && sysctl -w net.inet.ip.forwarding=1 net.inet.ip.fw.enable=1"

Give that a try under sudo and let me know. It seemed to work for me

[joachimVdH]

the raw command works !

I also changed my cx.pow.firewall.plist to

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>
    <string>cx.pow.firewall</string>
    <key>ProgramArguments</key>
    <array>
        <string>/bin/sh</string>
        <string>-c</string>
        <string>ipfw add fwd 127.0.0.1,20559 tcp from any to me dst-port 80 in &amp;&amp; sysctl -w net.inet.ip.forwarding=1 net.inet.ip.fw.enable=1</string>
    </array>
    <key>RunAtLoad</key>
    <true/>
    <key>UserName</key>
    <string>root</string>
</dict>
</plist>

And it works fine even after 2 reboots to test it !

Thanks for continuing effort to get this working !!!

[jeremy]

Why is /bin/sh here but not the .eco template?

[paradox460]

Forgot to do it there, I'll push a commit in a couple of minutes that fixes that.

[jeremy]

Fixed by #458