macOS Sequoia + iperf3: Firewall problems

[n3gwg]

Output of brew config

Brewers,

I have brew installed on my macOS x86 Mac Mini and it works flawlessly. I used it to install iperf3 and ran iperf3 in server mode on the Mac Mini. I was able to run an iperf3 client on the same Mac and access its running iperf3 server. I also disabled my firewall and was able to use iperf3 from other systems (linux based) no problem.

However, when the macOS firewall was enabled I was unable to use iperf3 from other systems. I tried to add the iperf3 binary to the firewall but it would not accept it and see no place to add the iperf3 port to a text file anywhere. Can someone suggest a solution that might work so I can have iperf3 running on my Mac Mini and let the firewall allow it to have it's port open?

Thanks!

Stuart

Output of brew doctor

Not a brew problem per se

Description of issue

Trying to get macOS firewall to open up iperf3 port. Apparently the brew install of iperf3 did not do that.

[p-linnane]

Homebrew does not modify the macOS firewall settings. We never intentionally circumvent macOS security features. You are better off asking the iperf3 upstream since this is unlikely to be related to Homebrew itself.

[n3gwg]

p-linnane, et alia:

I absolutely understand the project's posture with respect to changing default security features within macOS as a matter of course. In fact, not only do a understand it but I entirely agree with it. However, I also have some other thoughts...

Any package that uses a port for a service that brew installs could ostensibly provide guidance to someone stating that if you want to allow this package to be accessed through the macOS firewall (such changes made at your own risk and peril) here is some documentation instructive to the same or maybe even a script, playbook, or command line example of how to accomplish it.

That would provide the person leveraging the brew package with requisite guidance to do so (if they made such an election) yet not disturb in any manner the consistency of the default security posture of macOS.

I will contact the iPerf3 authors as well as post into one of the macOS forums.

Thank you for your time and consideration regarding the issues before you with respect to the instant case.

Stuart

[gromgit]

Any package [...] that brew installs could ostensibly provide guidance

I've elided the condition in the above quote because the following should apply to any condition. As an active contributor (though not a Homebrew maintainer), I feel that this should not be done unless all the following hold true:

• it's unique to Homebrew's packaging, and
• it can't be easily figured out given upstream's documentation

For instance, several formulae mention the need to install brew install --cask xquartz for plotting functionality, because:

• it's not obvious at all that you need a separate X server on macOS (it's taken for granted on Linux where all of this software is developed), and
• Homebrew has a cask specifically for that, that most users don't know about

(Homebrew also currently doesn't allow formulae to depend on casks, so a caveat becomes the reasonable way to communicate this need to the user.)

In the case of iperf3:

• an active macOS firewall is far from common,
• anyone who activates this firewall is naturally assumed to be knowledgeable about what it affects, and
• any instructions given may well change between macOS versions, independent of iperf3

So any guidance should properly be done upstream, not at the packaging level. (I note that both MacPorts and Fink don't mention the effects of an active macOS firewall in their respective iperf3 packages either, nor on any other package that requires network service.)