Shared Network is not working when host Mac M1 Firewall is enabled

[ilyaresh]

Running UTM 3.0.4 on Mac M1 OS 12.01.
If I have host Mac's Firewall enabled I'm not getting assigned ipv4 IP on the guest VMs (currently playing with centos 7 x86_64, but I think I also had it with arm ubuntu).
if Firewall (on Mac host) is enabled and you try to down/up the interface it will timeout.

when Firewall (on Mac host) is disabled the interface comes up nicely

and I have ipv4

I've tried to add UTM as "allowed" app like that, but it doesn't help

[adespoton]

Interesting... I've been getting spotty acceptance of Shared Network across a number of my VMs, and you may have just helped me isolate the culprit: I think that Little Snitch may be to blame for the Shared Network interface failing to come up in some situations. I'll add "look at how shared network is implemented" to my backlog of things to investigate :) Possibly there's a sanity check it's doing that fails if certain packets are blocked.

[digitalqualms]

For a macOS 12.4 VM, I had to add /System/Library/Frameworks/Virtualization.framework/Versions/A/XPCServices/com.apple.Virtualization.VirtualMachine.xpc/Contents/MacOS/com.apple.VirtualizationVirtualMachine to the allowed firewall settings. Since it's inside an .xpc package, I had had to browse for it in Finder, "Show package contents" and then drag it to System Preferences.

Shared networking worked after that.

For other VM types, you might look at the process hierarchy in Activity Monitor under UTM to see if there are any other processes that might do the trick

[fulldecent]

For me in macOS Ventura 13.0, this option was not selectable:

[Issac-Lopez]

This is the workaround for this issue in Ventura that worked for me.

For a macOS Ventura 13.2.1 (22D68), the following terminal command allowed me to change the Firewall settings.

sudo /usr/libexec/ApplicationFirewall/socketfilterfw --add /System/Library/Frameworks/Virtualization.framework/Versions/A/XPCServices/com.apple.Virtualization.VirtualMachine.xpc/Contents/MacOS/com.apple.Virtualization.VirtualMachine

Restarted MacBook, path was added to Firewall as, allows incoming connections. This solved an unreachable network issue that occurred while in Shared Network mode for all of my VMs.

[hraban]

Wow unbelievable. This works for me!

Tip if you can't select it (e.g. on Sonoma): after opening its containing folder (by dragging it to the file selector window from finder), you can right click the item and select "Quick Look". This will open quick look; close that: now the item is selected and you can click "open".

Insanity.

[adespoton]

Ah; I use Little Snitch instead of the built in firewall, so have never run into this issue.

…

-Em

On Jun 13, 2022, at 10:12 AM, digitalqualms ***@***.***> wrote:  For a macOS 12.4 VM, I had to add /System/Library/Frameworks/Virtualization.framework/Versions/A/XPCServices/com.apple.Virtualization.VirtualMachine.xpc/Contents/MacOS/com.apple.VirtualizationVirtualMachine to the allowed firewall settings. Since it's inside an .xpc package, I had had to browse for it in Finder, "Show package contents" and then drag it to System Preferences. Shared networking worked after that. For other VM types, you might look at the process hierarchy in Activity Monitor under UTM to see if there are any other processes that might do the trick — Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you commented.

[alshdavid]

I had had to browse for it in Finder, "Show package contents" and then drag it to System Preferences.

Seems like this isn't possible in Ventura as drag drop doesn't work with the Firewall settings. Is there a terminal command I can use?

[Issac-Lopez]

For a macOS Ventura 13.2.1 (22D68), the following terminal command allowed me to change the Firewall settings.

sudo /usr/libexec/ApplicationFirewall/socketfilterfw --add /System/Library/Frameworks/Virtualization.framework/Versions/A/XPCServices/com.apple.Virtualization.VirtualMachine.xpc/Contents/MacOS/com.apple.Virtualization.VirtualMachine

Restarted MacBook, path was added to Firewall as, allows incoming connections. This solved an unreachable network issue that occurred while in Shared Network mode for all of my VMs.

[virtu]

None of the above suggestions worked for me.

I added qemuhelper and qemulauncher in addition to UTM and com.apple.VirtualizationVirtualMachine to the firewall exceptions. My setup has been working for months, now, after a reboot, no more network in shared network mode. Bridge mode works, but it's not what I want.

[secangkirkopipanas]

Hi @virtu,

Your case is exactly the same as me. Now I'm using Bridge mode waiting for solution/workaround for Shared Network. Not really sure what's the root problem.

[tfgcampos]

I think I solved this by adding /Applications/UTM.app and /Applications/UTM.app/Contents/XPCServices/QEMUHelper.xpc/Contents/MacOS/QEMULauncher.app to firewall exceptions. To add the later, you need to drag and drop from Finder after clicking the Plus (+) icon in firewall settings.
Can you try?

[boogi]

Will add that I just tried this approach (and everything else mentioned above) and it didn't work. UTM 4.4.4(92). Distro "Debian (Rosetta)" (from UTM Gallery). Host is Mac M1, Sonoma 14.1.1.
Issue might be with Cisco VPN (that I can't disable as it's corporate laptop).
Bridge mode works fine.