Knowledge Base: Weird Firewall behavior on OS-X El-Capitan.

[rekendahl]

I had issues accessing my two El-Capitan macs running mosh 1.2.5.

Here is the good news: I got it to work and issue is with OS-X and not blink
Here is the bad parts: I don't know what is the root cause and I don't know a 100% correct fix but here are my symptoms/history/"solution"

I have two macs. One at work and one at home. Both running el-capitan and with mosh installed through home-brew. I couldn't access either mac from blink (more then occasionally) while I could access one mac from the other (and even from a separate CentOS linux install). Blink's mosh client would timeout right away saying no traffic seen on UDP port 60

The issue is with the El-Capitan firewall. It seem to not remember that mosh has been approved for incoming traffic (not sure when knowledge is lost? some update?). During debug it would occasionally open a dialog asking if I wanted to approve incoming connections. When that happened it would work that one time then not work gain.

Since I had same issue with two OS-X machines I suspect more people will see this issue.

I was able to get it to work on my machines doing the following steps (in random repeated order):

1. Turning off OS-X firewall always makes mosh + blink work. If this is an option for you (say you're MAC is behind a corporate firewall) then simply do that but I wouldn't recommend it.
2. I played with combinations of the following: (while trying to access the mac from blink after each step):
   1. brew uninstall mosh; brew update; brew install mosh
   2. Open Firewall settings and click '+' sign then ALT+SHIFT+g and then type '/usr/local/bin/ and then select 'mosh-server'
   3. Turn fire-wall on/off
   4. Reboot

At some point going through these steps many times it started working on one machine. I thought I understood the fix but when testing that on the other machine I had no luck. I kept doing these steps not he 2nd machine and it started working.

BLINK for iOS is reporting the correct issue (I believe) the UDP ports on OS-X are blocked (for new connections). I don't know how to open UDP ports directly on OS-X. That, I'm convinced, would fix this.

I think my root cause might be that I have had mosh installed on macs a long time and from different sources (home-brew or website directly) and it has gone through serval updates. Along the lines my firewall rules have broken. Somehow it would remember existing connections but not allow new ones.

If anyone else sees this problem and find a better solution please let me know!

NOTE! This is NOT an issue with blink (during the steps above I could at times not access through any mosh client). It's an issue between mosh-server and OS-X Firewall.

Hope this helps anyone else seeing similar issues.

[tariqmi]

I was having an issue on El Capitan with MacPorts installed mosh (in /opt/local/bin). The solution for me was to use the command line (instead of the UI) to allow incoming connections to mosh-server:

sudo /usr/libexec/ApplicationFirewall/socketfilterfw --add /opt/local/bin/mosh-server
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --unblockapp /opt/local/bin/mosh-server

Hope this helps.

[espentrydal]

Thanks, that fixed it for me. Note that the MacOS firewall command doesn't work with symlinks (attention programs installed with homebrew).

[kohmaeda]

Just adding to the above if you're like me and missed part about symlinks and brew:

$ brew info mosh

The line after https://mosh.org is where mosh is actually installed. For me it is /usr/local/Cellar/mobile-shell/1.3.0_1

$ sudo /usr/libexec/ApplicationFirewall/socketfilterfw --add /usr/local/Cellar/mobile-shell/1.3.0_1/bin/mosh-server

$ sudo /usr/libexec/ApplicationFirewall/socketfilterfw --unblockapp /usr/local/Cellar/mobile-shell/1.3.0_1/bin/mosh-server

[zbeekman]

Hi Fellow MacOS mosh trouble shooters, you rock! I was initially able to connect to mosh by adding the symlink to my firewall allowed applications through the GUI but then it stopped working. Adding the actual program and symlinks via the command line fix the issue for me. Thanks so much for posting this information!