macOS firewall - allow incoming connections via CLI

[Mxrk]

Hi, this question is not really blink related but I guess somebody figured it out and fixed it.
When I start a new API project on my mac I have to allow incoming connections because of the firewall. If I don't click "allow" I can't connect to that endpoint via other devices (or when using a VPN for remote development on the mac).

When I start a new projection via SSH only I don't get this message because it only appears in the mac UI, so I can't access the newly created server from other devices till I accept the dialog.
Disabling the firewall works... but this isn't a solution I want to use.

I tried using sudo /usr/libexec/ApplicationFirewall/socketfilterfw --add {path} which adds the folder to the firewall but seems like the popup still opens for applications inside that folder (same with --unblockapp).

Is there a better solution to fix this problem?

[yury]

Not direct answer, but have you tried https://tailscale.com ? It simplifies setups like that a lot.

[Mxrk]

Yes, I am using tailscale for remote development, but it's also happening when I am in the same network at home so it shouldn't be vpn related.

[yury]

Ok, I tested a little bit.

You should use path to actual app that start to listen ports not folder.

What platform do you use to develop? (node, rust, ...)?

[Mxrk]

Have the same problem with Go and probably every other language which ends up with a binary.

I also tried your way, so in my case:
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --add ...ltrAPI/ltrAPI

Which seems good, but I still get the dialog. And if I don't press allow I can't access the server.
Directly after pressing allow I can access the page from every device in the network.

[Mxrk]

Okay, it seems like they both just aren't in sync sometimes. After adding it multiple times it seems working, although I see an error while trying to add it.

This is also interesting: if I execute the command without sudo I get a positive result but it won't get added.

/usr/libexec/ApplicationFirewall/socketfilterfw --add .../ltrAPI/ltrAPI
Application at path ( ...ltrAPI/ltrAPI ) added to firewall

 /usr/libexec/ApplicationFirewall/socketfilterfw --unblockapp .../ltrAPI/ltrAPI
The application is not part of the firewall