Which ports are open on my Mac server?

Short answer: all of them, by default. Your Mac gets a public IP with no filtering at our network, except for a small set of ports known to be abused for DDoS attacks.

What we don't restrict

Any TCP port, any protocol, any standard UDP port not on the amplification blocklist. Run whatever you want: web servers, SSH, Xcode build farms, VPN endpoints, game servers, CI runners, custom protocols. We don't inspect your traffic and we don't rate-limit normal use.

What we do restrict

To keep your server and our network from being dragged into reflection/amplification DDoS attacks, we filter a small set of UDP ports that are routinely abused for this. These filters normally don't affect anything you'd actually run as a service. The one most visible to Mac users is:

UDP 5353 (mDNS / Bonjour) is blocked inbound. Beyond the DDoS angle, this also stops your server from leaking its Bonjour name, advertised services and local hostnames to the public internet, which is a privacy gain.

Apple Remote Desktop and Screen Sharing

ARD and VNC on your public IP work normally. Because macOS uses Bonjour to enrich the connection with hostname, model, logged-in user and similar metadata, and mDNS is filtered at our edge, the ARD application will show a connected host with limited details. The session itself is not affected.

Tightening things up

If you don't want your Mac exposed directly, or want to combat the many automated bots and scanners hammering your SSH and VNC ports, you have several options:

  1. Run pf firewall on the Mac itself. Built in, free, flexible. See the our Firewall guide.

  2. Dedicated firewall and private network isolation. We offer this as an add-on for customers who want their Mac (or fleet of Macs) behind a managed stateful firewall on an isolated private VLAN, with public traffic reaching them only through defined rules. Useful if you host sensitive workloads, need to meet compliance requirements, or just don't want to manage pf rules yourself on each Mac separately. Contact us for pricing and setup.

  3. Overlay VPN for management access. Keep the server public for the services that need it, but move SSH/VNC/ARD onto an overlay network. Options that work well on macOS:

    • ZeroTier

    • Tailscale

    • WireGuard