Port forwarding rules?

[Shonke]

and, about the services running on the port?

OrbStack TCP 127.0.0.1:42506 (LISTEN)     # What is it used for?
OrbStack TCP 127.0.0.1:42507 (LISTEN)     # What is it used for?
OrbStack TCP [::1]:42507 (LISTEN)
OrbStack TCP 127.0.0.1:32222 (LISTEN)     # SSH service
OrbStack TCP [::1]:32222 (LISTEN)         # SSH service
OrbStack TCP 127.0.0.1:65374 (LISTEN)     # What is it used for?

[kdrag0n]

The localhost listeners (other than port 32222) are internal app services that, for one reason or another, can't currently use Unix sockets (though two of them should be migrated in the near future).

Port forwards match the listen address of the Linux side (0.0.0.0/:: or 127.0.0.1/::1), but privileged ports (<1024) listen on 0.0.0.0 and reject connections from all clients other than localhost because that's the only way to listen on privileged ports without root on macOS.

[Shonke]

I tested and found that privileged ports can be accessed from other computers on the local area network. Is this expected?
will you keep this?

[kdrag0n]

They can't. Connections are closed immediately if they're not from localhost.

[Shonke]

oh, I think I didn't make it clear
I mean listen to 443 (or other privileged ports) in the linux machine, and then other computers in the LAN can access

[kdrag0n]

If you listen on 0.0.0.0:443 in the machine, then it'll be accessible to other devices. IF you listen on 127.0.0.1:443, then it won't.