Blocking Incoming Connections

What are CIJScannerRegister.app, kdc and netboisd?
Should I see them in my Incoming Connections Options?
What affect does blocking them have?
I ask this after Apple Support failed to achieve Remote Login connections with me today. A possible factor?
Would appreciate your input.

See this post on CIJScannerRegister for more info on what it is and if you actually want to stop it
How to stop CIJScannerRegister to connect online?
NetBiosID if necessary if you connect to windows shares, it's part of the MacOS, it's not a threat.
KCD is to the best of my knowledge a part of the mac file transfer process for various protocols. It does not appear to be malicious, but rather a part of the Mac OS. You may want a second opinion on that one.

Similar Messages

Block incoming connection from ARDAgent?

Since I installed Snow Leopard, I have a window that pops up and tells me if I want to block incoming connection from ARDAgent(Remote Desktop App) every time I log in or turn on the computer, no matter if I block or allow incoming connections. Can anyone tell me how to stop this?

The blocking of incoming connections is in System Preferences>Security>Firewall
I think (not in front of a Mac at the moment). I would have thought that once
disabled it would remain disabled. Are you running in an admin account?
Dave

Block incoming connections to ix2-dl by internal firewall/iptables

Hi.
How do I block incoming connection to ix2? I opened rsync and forwarded the port but I need to block all IP except one. How do I do that?
I tried iptables, but they seem not to be working ("libkmod: ERROR ../libkmod/libkmod.c:505 kmod_lookup_alias_from_builtin_file: could not open builtin file '/lib/modules/2.6.31.8/modules.builtin.bin'").

The ix2-dl NAS is behind Windows NAT (RASS) and so I cannot apply firewall rules from there.
I think you should add firewall (e.g. iptables based) in next update.

Firewall Block incoming connections fails

Whenever I'm on the road or at clients loactions I set my firewall to block all incoming connections.
The explanation of Mac OS X is:
So it shouldn't matter if at the Sharing preferences you have enabled Screen or file sharing, which I have turned on, to be able to transfer files at home.
If "Block all incoming connections" is enabled, nobody should see you have any sharing options enabled. I always understood this is a sort of override.
Alas, this seems not the case. My laptop is actively promoting itself as a VNC enabled computer, while block all incoming connections is checked. Unchecking the screen sharing in the sharing preferences immediately has effect on this and stops VNC braodcasting.
Who knows more about this? Is this a bug or undocumented / wrongly documented feature?
Kind regards,
Roeland

PAHU wrote:
Roerei wrote:
Mac OS X explicitely states that "all sharing services" will be blocked.
And they are blocked. With this setting enabled, you cannot connect to the Mac from a remote computer.
What it does not say is that enabling this setting will stop the Mac from being advertised. If you want this then you will need to turn off File Sharing. This will stop the Mac from being seen on the local network.
So in summary, if you want to stop your Mac from being seen on someone else's network you are connected to, then disable File and Screen Sharing. Or trust that with the "Block all incoming" setting enabled, no other user will be able to connect to your Mac even though they can see it.
This is just stupid. Why advertise a service which is blocked? That is just plain dump and not very security minded. If you block a service, you also should not advertise that service. Especially in the firewall preferences checking that box greys out all other options, which gives you kind of the impression that you are stealth.
So you might be right, but it is just wrong.
Roeland

FIREWALL / EXPLORER ISSUES (No prompt on blocked incoming connections)

I've spent a week trying to identify the cause of this, and I've just cleared (deleted) several machines (VHDs), thinking they were exhibiting the symptoms, only to find my clean VHD installs are also ... infected?
My firewall appears correctly configured (default settings, nothing's changed)
but it's blocking programs (I think), and not asking me to set rules. I've searched the reg, no references of the exe, I've checked the firewall rules, nothing there. In my configured systems (I've just deleted) I even reverted to factory service settings,
in case I'd stopped/manualised something that needed to be automated....
I'd compared registry shots. Nada. And now I can't use my iPhone as a mouse, and god knows what other problems are in there.
Is this a malware issue? How can I test to see what's blocking 'networked' programs (incoming connections / interactive services)?

Maybe it's an issue with the setup. rebooted into bad build that doesn't have this issue.. worked
when it works
About to retry newly extracted files.. thought I'd try them on this machine.. FAIL. Which means there's an issue with the path (?), or some info is written somewhere about the program when it's extracted (again, ?).
when it doesn't work, then does work...
Ok, my money's on path, and my question is this: if you run an .exe off a usb, for example, will windows firewall prompt and manage that program?
I'm wondering if the OS (f/w mgr) is not seeing the app, and therefore not prompting for mgmt...
Moment of truth: rebooting to new build to test (more) 'local' execution of program!

Logging into home remotely - is Verizon blocking incoming connection requests?

I'm trying to set up my computer at home so that I can access it from my in-laws, who are also FIOS customers and from my Android device via Sprint's network.   Both of these use SSH as the protocol, and on the theory that port 22 might be blocked, I set up the Actiontec to map an alternate port (1977) to port 22 on my server. My first attempt was to use the port forwarding capability in the router, but I have been unsuccessful in establishing a connection from outside my network.
I've tried configuring my server as the DMZ for the Actiontec, which makes me nervous, but I was running out of ideas. I even turned the firewall off on the PPoE connection but that didn't help either.
From outside my network, I can ping the WAN IP address assigned by Verizon to my router, so inbound ICMP packets are OK, at least as far as getting to the Actiontec
I can log onto my server while on my local network, but not from outside the network.
I'm running out of ideas. Does anyone know of a way to dump packets coming to the Actiontec so that I can tell if the inbound TCP packets make it to my router?
Does Verizon block inbound TCP requests for residential service? For all ports?
                                  Thanks for any info,
                            Joe H.
{edited for privacy}
Solved!
Go to Solution.

I don't have it working yet, but I was able to run a test that forwarded the port to my laptop and I see (via wireshark) the inbound connection. So, while I can log into my server locally, I must have some sort of firewall rule on that server that's preventing connections from the outside.
Verizon, I apologize for implying you were blocking.   This looks like a local issue on my end.

What is the fix for some applications repeatedly asking permission to accept incoming connections?

What is the fix for some applications repeatedly asking permission to accept incoming connections?
On every restart, AutoPairs and Epson Event Manager asks me to reject or agree to allow incoming connections. It is very aggravating and time-wasting. I know other Mac users who have the identical problem with other applications on their Macs.
Isn't there some way to make my Mac understand that "Yes" means "Yes" once and for all?
I am presently running Yosemite, but this was a problem with prior OS X versions too.
Respectfully,
Nate

This is a comment on why you might, or might not, want to use the built-in Application Firewall.
The firewall blocks incoming network traffic, regardless of origin, on a per-application basis. By default it's off, and when turned on, it allows applications digitally signed by Apple, and only those applications, to listen on the network. It does not block outgoing traffic, nor can it distinguish between different sources of incoming traffic, nor does it filter traffic by content.
No matter how it's configured, the firewall is not, as some imagine, a malware filter. If that's what you expect it to do, forget it. All it will do is bombard you with pointless alerts.
Consider some scenarios in which you may expect the firewall to be useful.
1. You enable file sharing, and you allow guest access to certain folders. That means you want people on your local network, but not outsiders, to be able to access those shared folders without having to enter a password. In the default configuration, the firewall will allow that to happen. The router prevents outsiders from accessing the shares, whether the application firewall is on or off. But if your computer is portable and you connect it to an untrusted network such as a public hotspot, the firewall will still allow access to anyone, which is not what you want. It does not protect you in this scenario.
2. You unknowingly install a trojan that steals your data and uploads it to a remote server. The firewall, no matter how it's configured, will not block that outgoing traffic. It does nothing to protect you from that threat.
3. A more likely scenario: The web browser or the router is compromised by an attacker. The attack redirects all web traffic to a bogus server. The firewall does not protect you from this threat.
4. You're running a public web server. Your router forwards TCP connection requests on port 80 to your Mac, and the connections are accepted by the built-in web server, which is codesigned by Apple. The application firewall, still configured as above, allows this to happen. An attacker hacks into the system and tries to hijack port 80 and replace the built-in web server with one that he controls. The good news here is that the firewall does protect you; it blocks incoming connections to the malicious server and alerts you. But the bad news is that you've been rooted. The attacker who can do all this can just as easily turn off the firewall, in which case it doesn't protect you after all.
5. You're running a Minecraft server on the local network. It listens on a high-numbered port. You, as administrator, have reconfigured the firewall to pass this traffic. An attacker is able to log in to a standard account on the server. He figures out how to crash Minecraft, or he just waits for you to quit it, and then he binds his own, malicious, Minecraft server to the same port. The firewall blocks his server, and because he's not an administrator, he can't do anything about it. In this scenario, the security is genuine.
6. Here is a more realistic scenario in which you might have reason to enable the firewall. Your MacBook has sharing services enabled. You want those services to be available to others on a home or office network. When you're on those networks, the firewall should be off. When you move to an untrusted network, you can either turn off all the services, or enable the firewall with a non-default configuration to block them. Blocking is easier: one click instead of several.

Firewall in set access mode let "allow incoming connections" without me

I have set up my firewall to allow incoming connections for a file sharing client under "Set Access for specific services and applications", and I noticed that Skype, iChatagent, and Safari all included themselves to be set under allow as well a week later. I did not enter this in manually. How did this occur?

I am quite befuddled by the 10.5 firewall. Maybe I'm thinking too much, but I've read all the documents I could get a hold of, and I still find it confusing and often conflicting in the specifics.
For starters, there is the cryptic remark of ""Mac OS X normally determines which programs are allowed incoming connections. Select this option if you want to allow or block incoming connections for specific program." Presumedly the "option" it is referring to is the "Set access for specific services..." option, which implies that the "normally determines" circumstance refers to the first two options. But, "Allow all incoming connections" supposedly allows everything, and "Allow only essential services" supposedly blocks everything (except for two or three things). Where in either of these cases would OS X be "determining" anything, and if it does, what criteria is it using?
The next thing I don't understand: when the option is set to "Set access for specific services", which applications does OS X explicitly ask permissions for? It seems that it since the firewall is only blocking incoming connections, it should only ask for applications that look like they want to accept incoming connections (i.e., server applications). But for me, it asks for permission for applications like Cyberduck (ftp app), and Microsoft Word 2004. In addition, the poster above mentioned Safari made it onto the list. To me, neither Cyberduck nor Safari should matter, since they are both purely client applications that only receive incoming data when it is requested by them, no? And what business does Word have in wanting to accept incoming connections? (maybe this is a question for Microsoft, not Apple).
Well, I have a list of other questions about half a page long, but if anyone can help with those two, it would be a big help.

McAfee frequently warns me that Firefox is trying to accept incoming connections from the Internet and asks me whether or not I want to allow or block this - what is this all about?

I cannot find any reference to this sort of activity by Firefox on your website. It is an '.exe' program location and McAfee warns me that "Hackers can use programs to steal your personal information or hijack your PC".
Can you please confirm that these incoming connections are legitimate Firefox activity, and if so please explain what they are, why they are required by Firefox and why there appears to be no reference to this activity on your website. Many thanks.

Hi Cor-el,
Thanks for your response.
No, unfortunately McAfee does not give any more detail as to the origin of these incoming connections - is there a way to find out from McAfee?
I would have thought that Mozilla Firefox should have the answers, but I have been unable to find any reference to this issue on their website, Help section etc.
Could it be the way my Options are configured? - although I've not changed them from the Default settings as far as I can remember.
Cheers,
GWhatsitworth.

Canon MP560 Scanner Problems - Allow Incoming Connections and Sharing

Though I have allowed incoming connections for my scanner, I'm prompted every time I want to scan. In addition, I've also selected so share my scanner in the Print and Fax window. However, it automatically deselects.
Help!
Oh, and I've also allowed incoming connections for the DVD/CD sharing but according to the Sharing menu, it's blocked by the firewall. I don't understand. =S

I'm not sure what you mean by prompted every time you want to scan, but if you have the scanner driver and not the Canon Scan utility in the permitted list, then this could be the issue.
To add the Canon IJ Network Scan Utility to the list of allowed programs.
1. Open System Preferences > Security and select the Firewall tab.
2. Enable “Set access for specific services and applications
3. Click the + icon
4. Browse to Mac HD > Library > Printers > Canon > BJPrinter > Utilities and select Canon IJ Network Scan Utility. Click Add
5. Ensure the Canon IJ Network Scan Utility is set to ‘Allow incoming connections’.

Multiple Incoming Connections to Skype

Hi!
When I initiated a call today, I began being bombarded by multiple incoming connection attempts from many different IPs, from many parts of the world. I couldn't deny all incoming connections, obviously, so I set it to allow all so I could finish the call without playing whack-a-mole.
What are these connection attempts about? And, if they're malicious, what kind of rule should I set to block them?

Hi,
Is the customer trying to login with a single username for more than 3 times?
If yes, and you want to change the simultaneous login then edit the group-policy and vpn-simulateously -login parameter. vpn-simulatenous-login is set to 3 by default.
The following link gives details of the same:
http://www.cisco.com/en/US/products/ps6120/products_tech_note09186a00807e0aca.shtml#vpnc-sol-1
Hope this helps.
Regards,
Anisha
P.S.: please mark this thread as answerd if you feel your query is resolved. Do rate helpful posts.

Why do apps need *repeatedly* need permission to allow incoming connections

Even though I have added them to the list of allowed programs in the Security preference pane, many apps still ask me to “Allow” or “Block” access to incoming connections for my firewall. In the same dialog it recommends that I can avoid seeing this in the future by adding this app to my list of allowed programs—but I've already done so! And it's still asking me for permission.
Why?

Two things come to mind: (a) your ALF is borked and (b) the apps keep changing (for example, you add an app and then update it with a new version).
Try removing the file called com.apple.alf.plist in *Macintosh HD/Library/Preferences/* and rebooting. Then just add the "offending" applications as they request that they should.
<Edited by Moderator>

All Applications Cause Firewall's "Accept Incoming Connections" Prompt

Every time I open a "Save," "Save As," or "Open" dialog box, in any application, I get multiple prompts from the firewall to allow or deny incoming connections for that application. The prompt disappears almost immediately. This occurs in applications I've listed as exceptions as well as those unlisted.
A few other things I've observed:
- This happens while I'm connected to my Windows 7 machine on over the home network.
- If I unmount the other computer, I no longer get the prompt.
- It doesn't happen when I've mounted another Mac.
- It doesn't happen when I block all incoming connections, but then file sharing doesn't work either.
- It happens in every application, including System Preferences.
What I've tried:
- Deleting the firewall's plist file in /Library/Preferences
- Removing all exceptions and disabling/reenabling the firewall and the option to block all incoming connections.
I've seen this question asked numerous times in various places on the internet, and I have yet to find a solution. Some suggest reinstalling every application that does this, while others recommend disabling the firewall altogether. I don't see either of these is a solution. None of the other versions of this question have referenced the presence of a mounted network computer.
Thanks for your input.

Try adding
/System/Library/CoreServices/Finder.app
to the Apple Menu -> System Preferences -> Security -> Firewall -> Advanced (after unlocking lock) -> "+" symbol
to add the Finder app to list of applications accepting incoming connections.
Not sure if this is a secure method, but it might be better than turning the firewall off altogether. Works for me for the time being, and I just thought of this after looking all over for a solution myself.

Incoming Connections Port Scan warning from anti-virus software

My anti-virus gave me a warning that a port scan had occurred on my Mac, after which I blocked the address of the incoming connection. Does this mean my computer has been hacked and what should I do? Today I also noticed two worrisome outgoing connections entitled "wwwalt2.infoyouaskedfor.com" and "Gemini.leadertech.com" that repeatedly kept appearing on my anti-virus network monitor, one after the other. I entered them in the "Whois" window but it didn't give me any information. My Mac Firewall was already set to only allow incoming connections from applications with certificates, so I don't understand how this happened.

Hi AML225;
Try ClamXav. It is free and runs will on Macs.
Norton even for free is terrible on a Mac. It causes more problems then it solves.
Allan

Incoming connections query

When I launch Final Cut or Batch Monitor, why do I keep getting a promt asking if I want to allow incoming connections? How do I get rid of this? It happens in Batch Monitor continuously and halts my other work.
Final Cut 7.0.3

try Compressor preferences, removing anything in the text box for email, outgoing server, browse network and DNS, then apply.
I should have stated in last post to block Compressor in; System Preferences > security > firewall > set access

Blocking Incoming Connections

Similar Messages

Maybe you are looking for