Yeah that works, but I’m trying to create a firewall rule to explicitly allow it with a default deny-all (ipfw workstation profile), and limited so it’s not accepting all ports from anything on LAN.
I think this is a misunderstanding about how TCP sockets work. The source port is not usually within your control from the server side. Operating systems on the client side use TCP source ports to keep track of which traffic returning from the server side need to be routed to which processes (sockets). The source port generally has no correlation to the destination port.
If, for instance, your operating system insisted on keeping these ports the same, then you would only be able to connect one socket at a time on a given destination port. This would have very annoying consequences like only being able to connect to one HTTP server at a time. Because of that, your OS will pick some random port (usually a pretty high number) for each outgoing connection.
All you need to care about on the server firewall side is the destination port, because that is the port that your service is binding to. The source port should be any because you have no practical control over what port the client machine will assign to the socket. The source address is the only worthy security consideration.
