Repository navigation
[Bug] Windows VM port forwarding errors with three-digit Mac host ports #67
Description
Description
A reported three-digit Mac host-port failure is now captured for port 443: VMPal warns that the port is already in use by another app. Four- and five-digit Mac host ports are accepted without showing that error, but the forwarded application is still not accessible from the Mac host. Acceptance of the rule in settings should not be interpreted as successful forwarding.
The port being changed is "This Mac's port", not "the VM's port". The observed behavior is:
| This Mac's port | Windows VM's port | Result |
|---|---|---|
8080 |
80 |
Accepted without a settings error; forwarding reported not working |
9999 |
443 |
Accepted without a settings error; forwarding reported not working |
17285 |
17285 |
Accepted without a settings error; application unreachable from Mac host |
443 |
Not shown in the warning screenshot | VMPal warns that Mac port 443 is in use by another app |
The screenshots show the four-digit rules configured in settings; they do not demonstrate a working connection to the guest. The earlier wording that these rules "work" meant only that VMPal accepts them without displaying an error.
Steps to Reproduce
- Open the Windows VM's network settings in VMPal and find Port Forwarding.
- Add a rule such as Mac
8080to VM80, or Mac9999to VM443. VMPal accepts the rule without the three-digit-port error, but forwarding still does not work. - Change the Mac-side host port to
443, keeping the Windows destination port the same. - Attempt to use the changed configuration. An error is shown.
The new screenshot shows the warning on the Windows VM in the VMPal VM list and identifies the Mac host port as 443. The guest destination port is not visible in that screenshot.
Current Behavior
-
Four- and five-digit Mac host ports are accepted without showing the settings error, but the application remains inaccessible from the Mac host. The concrete
17285 -> 17285reproduction is described below. -
With Mac host port
443, VMPal shows the warning quoted below. -
The newly supplied screenshot captures the exact warning for Mac host port
443:This Mac's port 443 is in use by another app, so its connections don't go to the VM.
It appears on the Windows VM's warning indicator in the VMPal VM list. The screenshot reports a port conflict for this specific host port; it does not establish that three-digit port numbers are generally unsupported. The earlier screenshots show the accepted
8080 -> 80and9999 -> 443settings.
Expected Behavior
Port forwarding should work with a valid, available Mac host port regardless of its number of digits, subject to any actual operating-system restrictions. If a port cannot be used, VMPal should explain the reason and any action needed.
The screenshot specifically reports a port conflict on Mac port 443; whether another application is actually holding that port has not been independently checked. The unreachable 17285 -> 17285 mapping also needs investigation. A shared cause has not been established, and the digit count alone should not be treated as the cause.
Additional reproduction: application on port 17285
An application running inside the Windows VM is accessible from within the VM at http://localhost:17285/.
I also configured this port-forwarding rule in VMPal:
| This Mac's port | Windows VM's port |
|---|---|
17285 |
17285 |
However, http://localhost:17285/ is not accessible from the Mac host, despite the 17285 -> 17285 forwarding rule.
Reproduction:
- Run the application inside the Windows VM and confirm that
http://localhost:17285/works inside Windows. - Configure VMPal port forwarding from Mac host port
17285to Windows VM port17285. - Open
http://localhost:17285/on the Mac host. - The application cannot be accessed from the host.
Expected: the Mac host should be able to reach the application through the configured forwarded port, provided the application is listening on an address reachable by the forwarding mechanism and guest firewall rules permit it.
This five-digit host port is accepted in VMPal settings, but the forwarded connection does not work. The report therefore covers both the port-in-use warning for Mac port 443 and accepted rules that still fail to forward traffic. The application's listening address, guest firewall behavior, exact host-side browser error, and whether this has the same cause as the port-443 warning have not been verified.
Environment
- App version: VMPal 0.89 (89)
- Mac: Apple silicon Mac mini, 24 GB memory
- macOS version: 27.0.1 (26A434)
- VM's OS: Windows 11 for Arm, 26H2 (as displayed by VMPal); exact build not recorded yet
- Feature: Network settings -> Port Forwarding
Screenshots
The first two screenshots supplied with this report were identical; that settings image is included once below. It shows the 8080 -> 80 and 9999 -> 443 rules accepted in VMPal settings. This is not evidence of successful forwarding: the application is still inaccessible from the Mac host, as described above.
Mac host port 443 warning
VMPal reports that Mac port 443 is in use by another app and that connections therefore do not go to the VM.
Log
No logs attached yet. The exact VMPal port-443 warning is recorded above; the host-side browser error for port 17285 has not been captured. This report is based on the reported settings errors and connectivity failures and has not been independently reproduced.


Activity
huyphams commentedon Oct 20, 2026
Hi @iambipinpaul, thanks for the detailed report. There are two separate things here, and neither is about the number of digits.
Mac port 443. macOS lets only root listen below port 1024 on
127.0.0.1, where VMPal’s forwarded ports listen, so a port below 1024 can never be forwarded, whether or not another app uses it. VMPal called that “in use by another app”. In VMPal 0.90 it says “This Mac’s ports below 1024 are reserved. Use one from 1024 to 65535.” and stops retrying. Use 8443 (or any port from 1024 up) for the VM’s 443.8080, 9999 and 17285. These listen on the Mac, and each connection goes to Windows at its port. When nothing answers, it’s usually on the Windows side:
localhostinside Windows. Check withnetstat -ano | findstr :17285: it needs0.0.0.0:17285or[::]:17285, not127.0.0.1:17285.New-NetFirewallRule -DisplayName "Port 17285" -Direction Inbound -Protocol TCP -LocalPort 17285 -Action AllowCould you check those two and tell us what you find? If it still doesn’t connect, please attach the VM’s log (Help › Show Logs in Finder).