Leopard's application level firewall :

Leopard's (OSX 10.5) firewall behaves significantly differently than the firewall shipped with OSX 10.4. The symptoms are that Tomcat seems unreachable ("kCFErrorDomainCFNetwork:302"), but unfortunately no log message clearly identifies the issue.
In some cases, Tomcat is only "partly" reachable; pages will appear, but some of the resources can't be loaded (broken images, missing stylesheets, ...) Another symptom is that you have to kill Tomcat to stop it (-HUP works), because the shutdown script can't reach the running process either.

We've tried a bunch of variations on the firewall settings, but nothing really help.

Solution

Well, it's pretty simple! Update to OSX 10.5.8 !

If you're using Snow Leopard, the issue was also present until 10.6.1, but is fixed as from 10.6.2 !

Some interesting links:

• http://securosis.com/2007/11/01/investigating-the-leopard-firewall/
• http://documentation.magnolia.info/administration.html#Knownissues which links back to here but has a nice little screenshot of Leopard's firewall configuration gui

"Max.files opened"

There might be some "max.files opened" issues, with settings which are different from Tiger(10.4), although this hasn't been reported in a while.