Solved: iTunes Home Sharing with Windows Firewall
I have read several hundred threads on this topic, and I would like to share the simple solution that I found after much effort.
Apple has indicated that the following ports are required:
port 123 TCP is used for network time sync (Apple TV)
port 5353 UDP is required for computer discovery using the Bonjour service
port 3689 TCP is required for iTunes Library Home Sharing
I have read advice from a number of people claiming that port 3689 should be UDP instead of TCP.
To test this, I set up two Windows7 machines side by side connected by wired ethernet through an unmanaged switch. I installed iTunes 11 on each of them, and turned on Home Sharing. The installation of iTunes automatically added windows firewall rules to allow inbound traffic from Bonjour and iTunes, but at that point iTunes Home Sharing did not work: the two computers each showed that it was connected to the other's library, but the shared libraries could not be loaded so no tracks were visible. However, turning off the Windows firewalls instantly made iTunes library sharing work perfectly. Turning the firewall back on made it stop working.
I then created 6 Inbound Rules to open the following ports:
5353 TCP
5353 UDP
3689 TCP
3689 UDP
123 TCP
123 UDP
After I added those rules, iTunes home sharing suddenly worked perfectly. I did not have to reboot nor did I restart iTunes -- as soon as I opened all the ports, the shared libraries appeared and I was able to play and transfer songs.
I then disabled the rules one by one and tested library sharing after each change. Everything kept working perfectly until I disabled port 3689 TCP. As soon as I disabled that port, everything stopped working. When I re-enabled it, everything worked again. Based on this test, I can report definitively that inbound port TCP 3689 must be open in order for iTunes Home Sharing to load a shared library and play or transfer songs, and that none of the other rules appeared to have any immediate effect on iTunes Home Sharing.
However, I must point out that since the firewall already contained rules for iTunes and Bonjour, some ports were already available to those programs -- and we know that Bonjour uses port UDP 5353 for computer discovery.
I then decided to try one more test: I turned off all my custom rules and just opened up the pre-existing iTunes rule and modified it to allow "Any" protocol type and "All Ports." With this simple change, iTunes Home Sharing worked perfectly.
Below is a snapshot of what I did: Control Panel -> Windows Firewall -> Advanced settings -> Inbound Rules -> iTunes -> Protocols and Ports -> change Protocol type to "Any" and Local port to "All."
You can see in the snapshot that I have deleted all the "wrong" rules and have disabled the custom rule I made for port TCP 3689, and that I have modified the original iTunes rule as described. I also left an inbound rule in place to open up port TCP 123, since AppleTV requires it for time sync.
**Note** -- I made sure my two machines were directly connected through a switch. There was no router between them, and neither machine was connected by a wireless connection. That's because all I wanted to do was to know for sure what firewall settings were required and prove that Library sharing could work if the firewall rules were set properly.
If your machines have to communicate through a router, or through a wireless access point that has routing rules in it, then it's possible that even after your firewall is set correctly you may still have problems with iTunes Home Sharing. If that happens, I would suggest first connecting your devices directly to the same physical switch and getting them working in that configuration before moving them back to their original positions. Then if things stop working, you will have to log into your router and check to make sure the following ports are not being blocked: TCP 3689, UDP 5353, and TCP 123.
I hope this may help somebody else to get things working. Much of the other advice I had read turned out to be wrong or irrelevant.
glhf
-- Craig
