Looking to Block Ports on AirPort Extreme

For the AirPort

By default all IPv4 ports on an AirPort base station are closed (not "hidden") to inbound traffic from the Internet as the base station employs a simple NAT-based "firewall." However, all ports are open going outbound.

If you are using a service on the Internet which you send traffic to, the return traffic will access the specific ports that application tells it to, to complete the loop. If your goal is to "close" that loop, then you will need to port forward that return traffic to a non-existent local network client as a potential workaround. Not sure how successful your application will be with certain communications being blocked.

Regardless, the workaround is to port forward the undesired inbound ports to a local IP address that is outside of the DHCP scope of the network. By default, the AirPort's DHCP service provides addresses in the 10.0.1.2 - 10.0.1.200 range. You would then port forward to address starting with 201, up to 254.

For example, if you want to block port 800, you would set up a port map in the AirPort Utility as follows:

• Run the AirPort Utility.
• Select the base station, and then, select Edit.
• Select the Network tab.
• Select the "+" plus button under Port Settings.
• Enter a description in the Description box.
• Public UDP Ports: 800
• Public TCP Ports: 800
• Private IP Address: 10.0.1.201
• Private UDP Ports: 800
• Public TCP Ports: 800

For your Mac

To block all incoming connections for a specific application, you would use System Preferences, as follows:

• System Preferences > Security & Privacy > Select the "+" plus button to add the application.
• Select the "Block incoming connections" option for that application.
• Select OK.

Note: If you want more control over the OS X software firewall, you will need to look into a third-party application that does this. A few are: Murus and Little Snitch

Without knowing more specifics, at best, I can only say "possibly." You can certainly give either or both the AirPort and/or the Mac suggestions a try to see if either will work for your situation. Regardless, they are just workarounds and not a true solution. More likely, you may have to consider using a dedicated firewall networking appliance.

As far as entering single or multiple ports, let's try another example. Let's say you need to block ports 500, 700, 800, 801, 802, & 5000 thru 6000.

The settings would look like the following:

Public UDP Ports: 500, 700, 800-802, 5000-6000

These would be the same values for each of the port fields in the utility. They would all go to the same local IP address.

For future reference:

• Individual ports should be entered with a comma and space after them.
• A series of ports can be entered with the first and last value separated by a hyphen.

The AirPort information that Tesserax has provided assumes that you have your AirPort Extreme set up in a Router Mode of DHCP and NAT.....and not "Off (Bridge Mode)".

The reason for this would be that there are no port settings for the AirPort router when it is setup in Bridge Mode.

If you are not sure what setting the AirPort Extreme is actually set to at this time, you can check the Router Mode setting using AirPort Utility on your Mac.

Open AirPort Utility (Finder > Applications > Utilities > AirPort Utility)

Click on the AirPort Extreme, then click Edit in the smaller window that appears

Click the Network tab at the top of the next screen

Check the setting for Router Mode

Got it, thanks.

In the last few days, we had a user who was asking how to forward ports on an AirPort router when the Port Mapping settings on his AirPort router were "not even visible". There was a reason for that, but the user would not accept it.....mentioning that his friend, "who knows computers" had told him that he had to set up ports on his AirPort no matter what.

Sorry, but again, without any specifics on the gaming application's networking requirements, I really don't have much else to offer at this time.

The other issue is if you are hosting a game server does your ISP support this with the type of Internet service they are providing you. Unless you pay extra, most likely, you are getting a consumer-grade level of service. This type of service typically has better download than upload bandwidth. Also with this type of service some ISPs will not provide you with a true public IP address. Instead they would provide you with a private IP, starting with 10, 172, or 192. This type of addressing will not work for user access to a game server.

Thanks for the detailed information. This is what neither the AirPort nor OS X's firewall natively can support. You will have to use either Murus or Little Snitch to have this much control for firewall rule setting.

Can't say for sure as I don't access GTA V online. However, you can download a trial version of Little Snitch and find out for yourself if it will do what you need it to.

Little Snitch (or Murus) will allow you to create firewall rules for the OS X software firewall similar to what you were provided for the Windows firewall. However, since you cannot do this natively with the OS X firewall interface, as I mentioned earlier, applications, like Little Snitch, can take full advantage of it.